Splunk Search

How to onboard csv files using Monitor with specific requirements?

rajim
Path Finder

I have .csv file which would be on-boarded into Splunk using Monitor. It has two specific requirements as below:

  1. The first 16 lines will be ignored.
  2. The file will be updated once in a day. The whole file will be refreshed. But the refreshed file will contain few new or modified records. So I only have o consider those records for uploading into Splunk in each day.

So, can anyone please help me how to
1. write the inputs.conf, props.conf or transforms.conf(if require)?
2. how to write the field extractor in Search Head?

Thanks in advance.

0 Karma

deepashri_123
Motivator

Hey@rajim,

For the second point splunk will take care by itself.
Refer this link:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Monitorfilesanddirectories

For the first point if you want the 17th line to be your header than add following to your props:
HEADER_FIELD_LINE_NUMBER = 17
CHECK_FOR_HEADER=true

Let me know if this helps!!

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...