How to forward csv data files from sharepoint online to splunk cloud

[untieshoe]

I don't mean SharePoint activity, admin or audit logs. I mean actual data files (that will be converted later to lookup files in Splunk Cloud).

Basically, do I need to extract the CSV files from SharePoint first (eg to a traditional on-prem file share by way of Power Automate) and use a UF to forward the files to Splunk Cloud, or is there some other nifty way to forward CSV data files directly from SharePoint Online to Splunk Cloud, or some other intermediary method?

Thank you.

[marycordova]

I haven't used PowerAutomate...so I don't know if this is possible...but could PowerAutomate create an HTTP post event and send the data to a Splunk HEC endpoint?

[marycordova]

LOL here's ChatGPT, looks like PowerAutomate does have an HTTP post...IDK if it can read a full file, but it probably can 😁

marycordova_0-1750881172924.png

[untieshoe]

Yes, that looks like a viable approach. Thank you. Too bad Power Automate is tricky and I'm not a programmer. I'll leave this discussion open for a few in case anyone has already achieved the goal and wants to share.