Getting Data In
Highlighted

Not able to read CSV from Universal forwarder

Explorer

I am trying to read csv from one of my universal forwareder, below is my inputs file

[monitor://D:\DUMP\Updated_Dump*.CSV]
sourcetype=csv
disabled=false
index=xyz
crcSalt=

After checking splunkd log getting below events
INFO TailingProcessor - Adding watch on path: D:\DUMP
INFO TailingProcessor - Parsing configuration stanza: monitor://D:\DUMP\Updated_Dump*.CSV

Please let me know how this can be resolved.

0 Karma
Highlighted

Re: Not able to read CSV from Universal forwarder

SplunkTrust
SplunkTrust

Those are informational messages, I don't see an error. Also, don't set a crcSalt if you don't need any.
The file is not getting ingested? Any WARN or ERROR messages from TailingProcessor in your log?

Skalli

0 Karma
Highlighted

Re: Not able to read CSV from Universal forwarder

Explorer

crcSalt= is there, pasting error .
file is not getting ingested, can't see my data in search head, anyway to troubleshoot ?

0 Karma
Highlighted

Re: Not able to read CSV from Universal forwarder

Super Champion

as per logs, it seems it is reading the log file.
what's the search you using to search the data? Have a search across all your splunk for some keyword from CSV. It might have come up as another sourcetype or different index

index=* sourcetype=* <somekeyword_from_csv_file> earliest=-1000d latest=+100d | stats count by sourcetype,index

run btool on sourcetype csv for props.conf & transforms.conf to check if it is getting overridden somewhere.

0 Karma
Highlighted

Re: Not able to read CSV from Universal forwarder

Explorer

I am using basic search - index=xyz sourcetype=csv

0 Karma