Getting Data In

required conf files to monitor csv data frequently

pavithra
Explorer

Hi All,

 

Please provide conf files ( inputs.conf,props.con,outputs.conf) to index the below format data on daily basis

pavithra_0-1723178237388.png

 

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

What have you tried so far and how does it fail to meet your expectations?

0 Karma

pavithra
Explorer

its not extracting the whole data

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You didn't say what have you tried so far. Maybe you have some small easily fixable mistake in your configs or maybe your approach is completely wrong. Show us what you've got.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pavithra ,

to answer to your question I need more information:

  • filename,
  • path,
  • column separator,
  • sourcetype,
  • index.

Anyway, supponing that the file is called "myfile2024-08-09.csv" and that the path is "/opt/data/files", you could use these:

inputs.conf

[monitor:///opt/data/files/myfile*.csv]
disabled = 0
index = your_index
sourcetype = your_sourcetype
host = your_host

Then you should also configure props.conf for INDEXED_EXTRACTIONS = CSV.

Ciao.

Giuseppe

 

0 Karma

pavithra
Explorer

Hi ,
Thanks for the response! Please find the details below

  • filename -BackupJobSummaryReport_2024-07-07-08-00-06 ( it will be in incremental order based on date)
  • path - C:\Users\_svcAPACCommVault01\OneDrive - Lendlease\Desktop\csv\*.csv
  • column separator,- 

     Client,Host Name,Total Jobs,Completed,Completed with errors,Completed with warnings,Killed,Unsuccessful,Running,Delayed,No Run,No Schedule,Committed,Size of Application,Compression Rate,Data Written,(Space Saving Percentage),Start Time,End Time,Protected Objects,Failed Objects,Failed Folders

  • sourcetype - backup
  • index - acn_lendlease_commvault



0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pavithra 

adding your information to the below inputs.conf:

[monitor://C:\Users\_svcAPACCommVault01\OneDrive - Lendlease\Desktop\csv\*.csv]
disabled = 0
sourcetype = backup
index = acn_lendlease_commvault
host = your_host

Ciao.

Giuseppe

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...