Getting Data In

Writing Application including regexes

CorpusCallosum
Explorer

Hi Guys

This question is not specific maybe but a conceptual.

I am writing an application. This application contains static CSV file including name, regex and tag columns.

What i want is if you install the application it automatically upload this CSV file and maybe make a lookup table from it. Views and Dashboards are ready. But i dont know how to automate uploading CSV and creating lookup table from it

Is there anyone suggest efficient way with en axample? I mean which config file i should use how to use it etc.

I would appreciate for any help
thanks

0 Karma

CorpusCallosum
Explorer

I have lookup default appserver bin and metadata folder. I put CSV in the lookup folder. All the config files are under default folder. i think i should use transform.conf to automate of taking CSV as lookup once application installed.

Any suggestion is welcome

0 Karma

aweitzman
Motivator

Have you referred to your transform stanza in props.conf? Something like:

[yoursourcetype]
LOOKUP-transformstanza = transformstanza name OUTPUTNEW regex

Check out the lookup sections of this page: http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Propsconf

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...

Keep the Learning Going with the New Best of .conf Hub

Hello Splunkers, With .conf26 getting closer, there’s already a lot of excitement building around this year’s ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...