Getting Data In

Writing Application including regexes

CorpusCallosum
Explorer

Hi Guys

This question is not specific maybe but a conceptual.

I am writing an application. This application contains static CSV file including name, regex and tag columns.

What i want is if you install the application it automatically upload this CSV file and maybe make a lookup table from it. Views and Dashboards are ready. But i dont know how to automate uploading CSV and creating lookup table from it

Is there anyone suggest efficient way with en axample? I mean which config file i should use how to use it etc.

I would appreciate for any help
thanks

0 Karma

CorpusCallosum
Explorer

I have lookup default appserver bin and metadata folder. I put CSV in the lookup folder. All the config files are under default folder. i think i should use transform.conf to automate of taking CSV as lookup once application installed.

Any suggestion is welcome

0 Karma

aweitzman
Motivator

Have you referred to your transform stanza in props.conf? Something like:

[yoursourcetype]
LOOKUP-transformstanza = transformstanza name OUTPUTNEW regex

Check out the lookup sections of this page: http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Propsconf

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...

Developer Spotlight with Guilhem Marchand

From Splunk Engineer to Founder: The Journey Behind TrackMe    After spending over 12 years working full time ...

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...

The Problem: When Networks and Services Don't Talk Payment systems fail at a retail location. Customers are ...