Getting Data In

Writing Application including regexes

CorpusCallosum
Explorer

Hi Guys

This question is not specific maybe but a conceptual.

I am writing an application. This application contains static CSV file including name, regex and tag columns.

What i want is if you install the application it automatically upload this CSV file and maybe make a lookup table from it. Views and Dashboards are ready. But i dont know how to automate uploading CSV and creating lookup table from it

Is there anyone suggest efficient way with en axample? I mean which config file i should use how to use it etc.

I would appreciate for any help
thanks

0 Karma

CorpusCallosum
Explorer

I have lookup default appserver bin and metadata folder. I put CSV in the lookup folder. All the config files are under default folder. i think i should use transform.conf to automate of taking CSV as lookup once application installed.

Any suggestion is welcome

0 Karma

aweitzman
Motivator

Have you referred to your transform stanza in props.conf? Something like:

[yoursourcetype]
LOOKUP-transformstanza = transformstanza name OUTPUTNEW regex

Check out the lookup sections of this page: http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Propsconf

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Automated Threat Analysis: Available in ES Premier

Automated Threat Analysis: Centralize and Accelerate Phishing Investigations in Splunk Enterprise ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...