Getting Data In

Writing Application including regexes

CorpusCallosum
Explorer

Hi Guys

This question is not specific maybe but a conceptual.

I am writing an application. This application contains static CSV file including name, regex and tag columns.

What i want is if you install the application it automatically upload this CSV file and maybe make a lookup table from it. Views and Dashboards are ready. But i dont know how to automate uploading CSV and creating lookup table from it

Is there anyone suggest efficient way with en axample? I mean which config file i should use how to use it etc.

I would appreciate for any help
thanks

0 Karma

CorpusCallosum
Explorer

I have lookup default appserver bin and metadata folder. I put CSV in the lookup folder. All the config files are under default folder. i think i should use transform.conf to automate of taking CSV as lookup once application installed.

Any suggestion is welcome

0 Karma

aweitzman
Motivator

Have you referred to your transform stanza in props.conf? Something like:

[yoursourcetype]
LOOKUP-transformstanza = transformstanza name OUTPUTNEW regex

Check out the lookup sections of this page: http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Propsconf

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...