csv files are not monitoried from splunk forwarder

[Gowthamdevaraj]

Hello Everyone

I have set of CSV files created and need to be monitored in splunk, but these csv files are not getting monitored in splunk. but if i change the extension from .csv to .txt or .log then the files are getting monitored.

Kindly suggest

[gcusello · Accepted solution]

Hi @Gowthamdevaraj,
could you share your inputs.conf and a sample of your files?

Ciao.
Giuseppe

[Gowthamdevaraj]

Hello Giuseppe

thanks for the your quick feedback.

Inputs.conf as
[monitor://D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData*]
sourcetype = csv
crcSalt =
disabled = false
index = smartwheel

CSV data as :

RequirmentModules_URL,ModuleType,DNGProjectArea_ID,ModuleID,ModuleName
https://url,SYS Requirement Specification,_JKlkYdM0Eea6bf5_L3GBXB,1356077,Test_SYS
https://url,SYS Requirement Specification,_JKlkYdM0Eea6bf5_L3GBXB,1194750,ESS_SysRS

[gcusello]

Hi @Gowthamdevaraj,
ok, I think that your filenames are something like this: ExporterData2020-03-31.csv, is it correct?
so, please, try adding extention to the monitor command:

[monitor://D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData*.*]

For the next time, please use the Code Sample Button for Code and samples.

Ciao.
Giuseppe

[Gowthamdevaraj]

Hi @gcusello

Nope, I have some there sub folders namely CCM,QM.RM inside ExporterData and these sub solders have 40+ csv files with unique names.

[gcusello]

Hi @Gowthamdevaraj,
if you have files and folders like these:

D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData\CCM\*.csv
D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData\QM\*.csv
D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData\RMM\*.csv
D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData\*.csv

use this monitor:

[monitor://D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData\...\*.csv]

Ciao.
Giuseppe

[Gowthamdevaraj]

Hello @gcusello

It worked, Thanks. But this was not the case with my earlier monitoring files. neverthless it worked.

Thanks