CSV file monitoring

[cbiraris]

Hi Team,

I am looking for the help to monitor the directory on heavy forwarder which contains CSV file.

can you please advise me which configuration files i need to update  and what configuration

for example-

server1 is the HF.
/opt/abc/file.csv is the directory and file name present on HF

Please advise.

Thank you,

[gcusello]

Hi @cbiraris,

you should search in internet or in the YouTube Splunk Channel documents and videos that describe how to get data in : https://www.google.com/search?q=splunk+getting+data+in&rlz=1C1VDKB_itIT1048IT1048&oq=splunk+getting+...

having an heavy Forwarder, you could do all the actions by GUI: [Settings > Inputs > File & Directories]

that guide you in the input creation.

The main job is to identify the sourcetype that in Splunk is what identifies a data flow, in your case, you should use the "csv" sourcetype or create your own sourcetype having the specifications od your csv, so you'll have all the field exactly extracted.

Here you can find an useful document : https://hurricanelabs.com/splunk-tutorials/ingesting-a-csv-file-into-splunk/

Ciao.

Giuseppe