Splunk Search

step by step, adding a new csv datasource

agthurber
Explorer

I'm was missing something really simple when trying to set up a new datasource, so i put these steps together as i followed the documentation and hope they can help someone out. If I got anything wrong please correct me but this is how i got it working for my needs

step 1: create the index "myindex", i am doing this from inside of the splunk GUI, give it a name and click save

Step 2: stop splunk so i can manually edit/create the conf files needed to perform the desired functions

step 3: create/append $SPLUNK_HOME/etc/apps/search/local/inputs.conf with the following values

[monitor://$SPLUNK_HOME/input/myfile.csv]
host=myhost
source=mysource
sourcetype=mysourcetype
index=myindex

step 4: create/append $SPLUNK_HOME/etc/apps/search/local/props.conf

[source::mysource]
REPORT-mysource = mysource_csv

step 5: create/append $SPLUNK_HOME/etc/apps/search/local/transforms.conf

[mysource_csv]
DELIMS = ","
FIELDS = "field1","field2","field3","field4","field5"

step 6: start splunk and look for indexed data and fields

1 Solution

agthurber
Explorer

got it to work, looks like i was having trouble locating the source after my initial experiments, so it was a simple mistake, but it was hard to find the cause, there was no obvious signs in the logs and no alerts popped up saying there was a problem finding the input file. Probably just a nubie issue but it would be nice to get some more feedback from splunk while trying to create the configurations needed to get the logs in.

hope this helps someone else along the way.

View solution in original post

agthurber
Explorer

got it to work, looks like i was having trouble locating the source after my initial experiments, so it was a simple mistake, but it was hard to find the cause, there was no obvious signs in the logs and no alerts popped up saying there was a problem finding the input file. Probably just a nubie issue but it would be nice to get some more feedback from splunk while trying to create the configurations needed to get the logs in.

hope this helps someone else along the way.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...