Getting Data In

csv files are not monitoried from splunk forwarder

Gowthamdevaraj
New Member

Hello Everyone

I have set of CSV files created and need to be monitored in splunk, but these csv files are not getting monitored in splunk. but if i change the extension from .csv to .txt or .log then the files are getting monitored.

Kindly suggest

0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @Gowthamdevaraj,
could you share your inputs.conf and a sample of your files?

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
Esteemed Legend

Hi @Gowthamdevaraj,
could you share your inputs.conf and a sample of your files?

Ciao.
Giuseppe

0 Karma

Gowthamdevaraj
New Member

Hello Giuseppe

thanks for the your quick feedback.

Inputs.conf as
[monitor://D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData*]
sourcetype = csv
crcSalt =
disabled = false
index = smartwheel

CSV data as :

RequirmentModules_URL,ModuleType,DNGProjectArea_ID,ModuleID,ModuleName
https://url,SYS Requirement Specification,_JKlkYdM0Eea6bf5_L3GBXB,1356077,Test_SYS
https://url,SYS Requirement Specification,_JKlkYdM0Eea6bf5_L3GBXB,1194750,ESS_SysRS

0 Karma

gcusello
Esteemed Legend

Hi @Gowthamdevaraj,
ok, I think that your filenames are something like this: ExporterData2020-03-31.csv, is it correct?
so, please, try adding extention to the monitor command:

[monitor://D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData*.*]

For the next time, please use the Code Sample Button for Code and samples.

Ciao.
Giuseppe

0 Karma

Gowthamdevaraj
New Member

Hi @gcusello

Nope, I have some there sub folders namely CCM,QM.RM inside ExporterData and these sub solders have 40+ csv files with unique names.

0 Karma

gcusello
Esteemed Legend

Hi @Gowthamdevaraj,
if you have files and folders like these:

D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData\CCM\*.csv
D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData\QM\*.csv
D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData\RMM\*.csv
D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData\*.csv

use this monitor:

[monitor://D:\01_ALMExporter_Reprots\Projects\SmartWheel\Data\ExporterData\...\*.csv]

Ciao.
Giuseppe

0 Karma

Gowthamdevaraj
New Member

Hello @gcusello

It worked, Thanks. But this was not the case with my earlier monitoring files. neverthless it worked.

Thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...