Getting Data In

Sending Data from Universal forwarder to splunk?

ajayabburi508
Path Finder

Hi Splunkers,

We have multiple csv files so we need to send data from Universal forwarder to splunk. We tried so many ways we didn't get proper results.

Please provide proper stazas for below data.

I have attached csv data below.

"User","Device type","Device model","UDID","Mac Address","Company Name","OS Version","Agent Version","Latest Config","Policy Name","Last Seen","Registration State","Owner","Hostname","Manufacturer","Config Download Count","Registration TimeStamp","Config Download TimeStamp","Keep Alive Timestamp","Device Hardware Fingerprint","Tunnel Version"
"00000000@example.com","IO","Ap dummydevice7,2","958-5F-4-9D-8D999F","00:00:00:00","cbt","Version 11.2.6 (Build 15D100)","1.1.0 (156893) ","No","Unknown","2018-05-14 11:12:19 GMT","Outdated","","","App","1","2018-05-14 11:12:19 GMT","2018-05-14 11:12:19 GMT","2018-05-14 11:12:19 GMT","95-5F-4D-9D-BB",
"00000000@example.com","OS","A dummydevice10,3","4D3E8-49-4CB5-93-3FF467910CEC","00:00:00:00:00:00","cbt","Version 12.0 (Build 16A5365b)","1.2 (165787) ","No","Unknown","2018-08-30 15:41:57 GMT","Outdated","","","A","1","2018-08-30 15:25:34 GMT",,"2018-08-30 15:41:57 GMT","4D-EF-4C-93-3F",

0 Karma

zacharychristen
Path Finder

This can be accomplished with a batch upload to Splunk. Note: this deletes the file upon indexing. If you have a script that copies the csv file to the batch upload directory, then this should work for what you need. If not, use the monitor stanza.

The following configurations are for the Universal Forwarder:

# inputs.conf
[batch:///var/log/mycsvfiles]
index = [YOUR INDEX]
sourcetype = [YOUR SOURCETYPE]
move_policy = sinkhole
whitelist = .*\.csv

# props.conf
[source::...csv]
TIMESTAMP_FIELDS = [TIMESTAMP FIELD IN CSV]
INDEXED_EXTRACTIONS = CSV
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...