Monitoring Splunk

CSV file monitoring

cbiraris
Path Finder

Hi Team,

I am looking for the help to monitor the directory on heavy forwarder which contains CSV file.

can you please advise me which configuration files i need to update  and what configuration

for example-

server1 is the HF.
/opt/abc/file.csv is the directory and file name present on HF

Please advise.

Thank you,

Labels (1)

gcusello
SplunkTrust
SplunkTrust

Hi @cbiraris,

you should search in internet or in the YouTube Splunk Channel documents and videos that describe how to get data in : https://www.google.com/search?q=splunk+getting+data+in&rlz=1C1VDKB_itIT1048IT1048&oq=splunk+getting+...

having an heavy Forwarder, you could do all the actions by GUI: [Settings > Inputs > File & Directories]

that guide you in the input creation.

The main job is to identify the sourcetype that in Splunk is what identifies a data flow, in your case, you should use the "csv" sourcetype or create your own sourcetype having the specifications od your csv, so you'll have all the field exactly extracted.

Here you can find an useful document : https://hurricanelabs.com/splunk-tutorials/ingesting-a-csv-file-into-splunk/

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...