Sending Data from Universal forwarder to splunk?

[ajayabburi508]

Hi Splunkers,

We have multiple csv files so we need to send data from Universal forwarder to splunk. We tried so many ways we didn't get proper results.

Please provide proper stazas for below data.

I have attached csv data below.

"User","Device type","Device model","UDID","Mac Address","Company Name","OS Version","Agent Version","Latest Config","Policy Name","Last Seen","Registration State","Owner","Hostname","Manufacturer","Config Download Count","Registration TimeStamp","Config Download TimeStamp","Keep Alive Timestamp","Device Hardware Fingerprint","Tunnel Version"
"[email protected]","IO","Ap dummydevice7,2","958-5F-4-9D-8D999F","00:00:00:00","cbt","Version 11.2.6 (Build 15D100)","1.1.0 (156893) ","No","Unknown","2018-05-14 11:12:19 GMT","Outdated","","","App","1","2018-05-14 11:12:19 GMT","2018-05-14 11:12:19 GMT","2018-05-14 11:12:19 GMT","95-5F-4D-9D-BB",
"[email protected]","OS","A dummydevice10,3","4D3E8-49-4CB5-93-3FF467910CEC","00:00:00:00:00:00","cbt","Version 12.0 (Build 16A5365b)","1.2 (165787) ","No","Unknown","2018-08-30 15:41:57 GMT","Outdated","","","A","1","2018-08-30 15:25:34 GMT",,"2018-08-30 15:41:57 GMT","4D-EF-4C-93-3F",

[zacharychristen]

This can be accomplished with a batch upload to Splunk. Note: this deletes the file upon indexing. If you have a script that copies the csv file to the batch upload directory, then this should work for what you need. If not, use the monitor stanza.

The following configurations are for the Universal Forwarder:

# inputs.conf
[batch:///var/log/mycsvfiles]
index = [YOUR INDEX]
sourcetype = [YOUR SOURCETYPE]
move_policy = sinkhole
whitelist = .*\.csv

# props.conf
[source::...csv]
TIMESTAMP_FIELDS = [TIMESTAMP FIELD IN CSV]
INDEXED_EXTRACTIONS = CSV