Splunk Search

How to get SharePoint excel files in to Splunk?



What is the best practice to get the SharePoint excel files, which will be added every week to get in to Splunk as lookups?

0 Karma


The best way is to pull the SharePoint list through a PowerShell Script and ingest in Splunk and schedule it through your heavy/light forwarder. Send the XML query that will look like this:
-- snip
< List>
< Query>
< Where>
< And>
< Geq>
< FieldRef Name='EventDate'/>
< Value Type='DateTime'>
< Today/>
< /Value>
< /Geq>
< Leq>
< FieldRef Name='EventDate'/>
< Value Type='DateTime'>
< Today OffsetDays='+30'/>
< /Value>
< /Leq>
< /And>
< /Where>
< /Query>
< /List>
-- endsnip

Use GetSPList command in Powershell to send the query and receive the results. You may need to install SPClient_x64 or SPClient_x86 based on your system. Cheers

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!