Getting Data In

How to configure a forwarder to regularly pick up data from a CSV file on a Linux server?

sundaresh83
Explorer

I have log and other data in a linux server. I am parsing the data using awk code and converting it into csv files. There is a forwarder installed in another location in the same linux server. How can I get the forwarder to pick the data (csv file) from its location regularly and ingest it into splunk? Is this the best way to do this? Or is there a better way of performing the same?
I have used splunk as a single instance on my laptop for analysis previously. But this is new. It would be great if there is a step by step guide.

0 Karma

miteshvohra
Contributor

This is something what I am currently using for working on sample data in CSV format and is working great for the demo setup.

[monitor://<path to csv>/*.csv]
sourcetype = csv
KV_MODE = csv
index = name_your_index
disabled = false
crcSalt = <SOURCE>

Would appreciate your feedback what worked for you.

Regards, Mitesh.

0 Karma

sundaresh83
Explorer

Hi Mitesh,

Thanks for the reply. Should this be in the input? I l test this and surely let you know how it works.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Guided Onboarding with Auto-schema Is Now Generally Available

  We are excited to announce the General Availability of Guided Onboarding with Auto-Schematization ...

ATTENTION: We’re Moving! (AGAIN!)

The Splunk Community Slack is undergoing a system migration to keep our workspace secure and ...

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

In this session, we will peel back the layers of Splunk Observability Cloud’s cost-optimization features. ...