Getting Data In

csv files are not monitoried from splunk forwarder

Gowthamdevaraj
New Member

Hello Everyone

I have set of CSV files created and need to be monitored in splunk, but these csv files are not getting monitored in splunk. but if i change the extension from .csv to .txt or .log then the files are getting monitored.

Kindly suggest

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Gowthamdevaraj,
could you share your inputs.conf and a sample of your files?

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Gowthamdevaraj,
could you share your inputs.conf and a sample of your files?

Ciao.
Giuseppe

0 Karma

Gowthamdevaraj
New Member

Hello Giuseppe

thanks for the your quick feedback.

Inputs.conf as
[monitor://D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData*]
sourcetype = csv
crcSalt =
disabled = false
index = smartwheel

CSV data as :

RequirmentModules_URL,ModuleType,DNGProjectArea_ID,ModuleID,ModuleName
https://url,SYS Requirement Specification,_JKlkYdM0Eea6bf5_L3GBXB,1356077,Test_SYS
https://url,SYS Requirement Specification,_JKlkYdM0Eea6bf5_L3GBXB,1194750,ESS_SysRS

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Gowthamdevaraj,
ok, I think that your filenames are something like this: ExporterData2020-03-31.csv, is it correct?
so, please, try adding extention to the monitor command:

[monitor://D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData*.*]

For the next time, please use the Code Sample Button for Code and samples.

Ciao.
Giuseppe

0 Karma

Gowthamdevaraj
New Member

Hi @gcusello

Nope, I have some there sub folders namely CCM,QM.RM inside ExporterData and these sub solders have 40+ csv files with unique names.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Gowthamdevaraj,
if you have files and folders like these:

D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData\CCM\*.csv
D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData\QM\*.csv
D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData\RMM\*.csv
D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData\*.csv

use this monitor:

[monitor://D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData\...\*.csv]

Ciao.
Giuseppe

0 Karma

Gowthamdevaraj
New Member

Hello @gcusello

It worked, Thanks. But this was not the case with my earlier monitoring files. neverthless it worked.

Thanks

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...