Getting Data In

How to upload and use a directory of binary files

splunklearner12
Path Finder

Network traces are stored in hundreds of binary files in a directory.

How do I upload those files (they won't get updated)?
In the Splunk settings, I saw how to upload a single script- but not a full directory.
I'm using a single instance.

0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

Splunk supports ingesting ASCII / human-readable data. You could technically ingest the files, but it really wouldn't be anything understandable. If there is a way to convert the binary to ASCII, then you could use a scripted input to run a script against the binaries. The script could dump the ASCII output to a directory which you could then monitor.

As for monitoring a whole directory, take a look at the docs here: https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Monitorfilesanddirectorieswithinputs.conf

View solution in original post

0 Karma

splunklearner12
Path Finder

I no longer need to use those binary files, so I'm accepting the below answer to close the question.

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Splunk supports ingesting ASCII / human-readable data. You could technically ingest the files, but it really wouldn't be anything understandable. If there is a way to convert the binary to ASCII, then you could use a scripted input to run a script against the binaries. The script could dump the ASCII output to a directory which you could then monitor.

As for monitoring a whole directory, take a look at the docs here: https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Monitorfilesanddirectorieswithinputs.conf

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...