Getting Data In

How to forward csv data files from sharepoint online to splunk cloud

untieshoe
Path Finder

I don't mean SharePoint activity, admin or audit logs. I mean actual data files (that will be converted later to lookup files in Splunk Cloud).

Basically, do I need to extract the CSV files from SharePoint first (eg to a traditional on-prem file share by way of Power Automate) and use a UF to forward the files to Splunk Cloud, or is there some other nifty way to forward CSV data files directly from SharePoint Online to Splunk Cloud, or some other intermediary method?

Thank you.

Labels (2)
0 Karma

marycordova
SplunkTrust
SplunkTrust

I haven't used PowerAutomate...so I don't know if this is possible...but could PowerAutomate create an HTTP post event and send the data to a Splunk HEC endpoint?

@marycordova
0 Karma

marycordova
SplunkTrust
SplunkTrust

LOL here's ChatGPT, looks like PowerAutomate does have an HTTP post...IDK if it can read a full file, but it probably can 😁

marycordova_0-1750881172924.png

 

@marycordova
0 Karma

untieshoe
Path Finder

Yes, that looks like a viable approach. Thank you. Too bad Power Automate is tricky and I'm not a programmer. I'll leave this discussion open for a few in case anyone has already achieved the goal and wants to share.

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...