Getting Data In

Indexing a CSV file from a server using REST API and Splunk SDK

dileepmandapam
New Member

Here is my use-case:
For every hour, I need to download a .csv file from my server using REST API. Using Splunk, I need to index these .csv files

My Approach:
Wrote a Splunk modular input app using Splunk SDK to download CSV files onto a user-specified folder on Splunk file system and
then Splunk monitors entire folder/directory.

Could you guys validate this approach?. Also looking for ways to optimize.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's a good way to do it. Another way would be to install a universal forwarder on the CSV server and have it send the files to Splunk as they are created.

---
If this reply helps you, Karma would be appreciated.
0 Karma

dileepmandapam
New Member

But downloading on to Splunk server is a good practice ?. Is it possible to write apps on Universal forwarder?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Best Practice is to use a forwarder.
Universal forwarders don't run apps, but you shouldn't need your MI with a forwarder on the server where the CSVs reside. If you really need the app, consider using a heavy forwarder.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...