How to ingest excel from UF

[Dayalss]

Hi,

I have a excel file on a linux server at a particular path.

I have created a input file to monitor this file , but Im not receiving any logs.

Can anyone help me how to get that excel daily by creating  a input.conf 

[gcusello]

Hi @Dayalss,

I confirm what @richgalloway said: there isn't any tool or Add-On to directly ingest Excel Files, the only way is passing through a csv conversion to perform out of Splunk before ingestistion.

You can do this is a script (e.g. in Python) like the ones described in these pages:

https://www.google.com/search?q=script+to+convert+an+excel+file+in+csv&rlz=1C1VDKB_itIT1048IT1048&oq...

Ciao.

Giuseppe

[richgalloway]

It depends on the type of Excel file.  A .xls file is binary and so will not be ingested by Splunk.  The UF's splunkd.log file should confirm this.

Newer Excel files are .xlsx, which is XML format.  That can be ingested by Splunk, but may be of limited utility if you can't interpret the XML.

There's also .xlsm files, which contain macros, but I'm not sure how they're stored.

Again, the UF should log a message when it's unable to monitor/ingest a file.