Getting Data In

Indexing a CSV file from a server using REST API and Splunk SDK

dileepmandapam
New Member

Here is my use-case:
For every hour, I need to download a .csv file from my server using REST API. Using Splunk, I need to index these .csv files

My Approach:
Wrote a Splunk modular input app using Splunk SDK to download CSV files onto a user-specified folder on Splunk file system and
then Splunk monitors entire folder/directory.

Could you guys validate this approach?. Also looking for ways to optimize.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's a good way to do it. Another way would be to install a universal forwarder on the CSV server and have it send the files to Splunk as they are created.

---
If this reply helps you, Karma would be appreciated.
0 Karma

dileepmandapam
New Member

But downloading on to Splunk server is a good practice ?. Is it possible to write apps on Universal forwarder?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Best Practice is to use a forwarder.
Universal forwarders don't run apps, but you shouldn't need your MI with a forwarder on the server where the CSVs reside. If you really need the app, consider using a heavy forwarder.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...