Exporting/Importing a CSV to new Splunk Enterprise instance

[Branden]

Hello. I cannot find a solution to this one here...

I have logs in one Splunk instance. I've exported them to CSV and want to perform a one-time ingest of that CSV into a new on-prem Splunk Enterprise instance. 

I have the CSV and can import it. However, I can't figure out how to preserve each row/event's original 'host', timestamp, and 'sourcetype' entry. When I do the import, it records the 'host' as the Splunk indexer, and the timestamp as the date of the import, which makes sense but is not the desired behavior.

Here is a sample row of the CSV:

_time,host,index,source,sourcetype
2024-11-19T11:36:05.000-0500,host1.example.com,test-index,/var/log/messages,syslog
2024-11-19T11:36:05.000-0500,host2.example.com,test-index,/var/log/messages,syslog

I removed the _raw column, but I can include it if necessary.

How do I import these events while preserving the event time, host, and sourcetype fields? Is this even possible? 

I looked around here and can't find anyone with this scenario. 

Thank you in advance!

[marnall]

You could make a transforms config which tells Splunk to extract the host field from the log:

# props.conf
[yoursourcetype]
TRANSFORMS-anynameyouwant = arbitrarytransformname

# transforms.conf
[arbitrarytransformname]
DEST_KEY = MetaData:Host
REGEX = ^[^,]*,([^,]+)
FORMAT = host::$1

Once this config is applied to your indexing tier, it will set the host based on the second column in your logs.

The default timestamp finder should also find the _time value from your logs in the first column, unless you are setting a sourcetype that bypasses the regular timestamp extraction. You might also try putting the logs to import into a file on the splunk machine using the cli and then making an inputs.conf to index it.

You should be able to set the sourcetype either from the inputs.conf stanza or in the webUI when uploading the logs.