Getting Data In

Sending Data from Universal forwarder to splunk?

ajayabburi508
Path Finder

Hi Splunkers,

We have multiple csv files so we need to send data from Universal forwarder to splunk. We tried so many ways we didn't get proper results.

Please provide proper stazas for below data.

I have attached csv data below.

"User","Device type","Device model","UDID","Mac Address","Company Name","OS Version","Agent Version","Latest Config","Policy Name","Last Seen","Registration State","Owner","Hostname","Manufacturer","Config Download Count","Registration TimeStamp","Config Download TimeStamp","Keep Alive Timestamp","Device Hardware Fingerprint","Tunnel Version"
"00000000@example.com","IO","Ap dummydevice7,2","958-5F-4-9D-8D999F","00:00:00:00","cbt","Version 11.2.6 (Build 15D100)","1.1.0 (156893) ","No","Unknown","2018-05-14 11:12:19 GMT","Outdated","","","App","1","2018-05-14 11:12:19 GMT","2018-05-14 11:12:19 GMT","2018-05-14 11:12:19 GMT","95-5F-4D-9D-BB",
"00000000@example.com","OS","A dummydevice10,3","4D3E8-49-4CB5-93-3FF467910CEC","00:00:00:00:00:00","cbt","Version 12.0 (Build 16A5365b)","1.2 (165787) ","No","Unknown","2018-08-30 15:41:57 GMT","Outdated","","","A","1","2018-08-30 15:25:34 GMT",,"2018-08-30 15:41:57 GMT","4D-EF-4C-93-3F",

0 Karma

zacharychristen
Path Finder

This can be accomplished with a batch upload to Splunk. Note: this deletes the file upon indexing. If you have a script that copies the csv file to the batch upload directory, then this should work for what you need. If not, use the monitor stanza.

The following configurations are for the Universal Forwarder:

# inputs.conf
[batch:///var/log/mycsvfiles]
index = [YOUR INDEX]
sourcetype = [YOUR SOURCETYPE]
move_policy = sinkhole
whitelist = .*\.csv

# props.conf
[source::...csv]
TIMESTAMP_FIELDS = [TIMESTAMP FIELD IN CSV]
INDEXED_EXTRACTIONS = CSV
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...