Getting Data In

Sending Data from Universal forwarder to splunk?

ajayabburi508
Path Finder

Hi Splunkers,

We have multiple csv files so we need to send data from Universal forwarder to splunk. We tried so many ways we didn't get proper results.

Please provide proper stazas for below data.

I have attached csv data below.

"User","Device type","Device model","UDID","Mac Address","Company Name","OS Version","Agent Version","Latest Config","Policy Name","Last Seen","Registration State","Owner","Hostname","Manufacturer","Config Download Count","Registration TimeStamp","Config Download TimeStamp","Keep Alive Timestamp","Device Hardware Fingerprint","Tunnel Version"
"00000000@example.com","IO","Ap dummydevice7,2","958-5F-4-9D-8D999F","00:00:00:00","cbt","Version 11.2.6 (Build 15D100)","1.1.0 (156893) ","No","Unknown","2018-05-14 11:12:19 GMT","Outdated","","","App","1","2018-05-14 11:12:19 GMT","2018-05-14 11:12:19 GMT","2018-05-14 11:12:19 GMT","95-5F-4D-9D-BB",
"00000000@example.com","OS","A dummydevice10,3","4D3E8-49-4CB5-93-3FF467910CEC","00:00:00:00:00:00","cbt","Version 12.0 (Build 16A5365b)","1.2 (165787) ","No","Unknown","2018-08-30 15:41:57 GMT","Outdated","","","A","1","2018-08-30 15:25:34 GMT",,"2018-08-30 15:41:57 GMT","4D-EF-4C-93-3F",

0 Karma

zacharychristen
Path Finder

This can be accomplished with a batch upload to Splunk. Note: this deletes the file upon indexing. If you have a script that copies the csv file to the batch upload directory, then this should work for what you need. If not, use the monitor stanza.

The following configurations are for the Universal Forwarder:

# inputs.conf
[batch:///var/log/mycsvfiles]
index = [YOUR INDEX]
sourcetype = [YOUR SOURCETYPE]
move_policy = sinkhole
whitelist = .*\.csv

# props.conf
[source::...csv]
TIMESTAMP_FIELDS = [TIMESTAMP FIELD IN CSV]
INDEXED_EXTRACTIONS = CSV
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...