Splunk Search

step by step, adding a new csv datasource

agthurber
Explorer

I'm was missing something really simple when trying to set up a new datasource, so i put these steps together as i followed the documentation and hope they can help someone out. If I got anything wrong please correct me but this is how i got it working for my needs

step 1: create the index "myindex", i am doing this from inside of the splunk GUI, give it a name and click save

Step 2: stop splunk so i can manually edit/create the conf files needed to perform the desired functions

step 3: create/append $SPLUNK_HOME/etc/apps/search/local/inputs.conf with the following values

[monitor://$SPLUNK_HOME/input/myfile.csv]
host=myhost
source=mysource
sourcetype=mysourcetype
index=myindex

step 4: create/append $SPLUNK_HOME/etc/apps/search/local/props.conf

[source::mysource]
REPORT-mysource = mysource_csv

step 5: create/append $SPLUNK_HOME/etc/apps/search/local/transforms.conf

[mysource_csv]
DELIMS = ","
FIELDS = "field1","field2","field3","field4","field5"

step 6: start splunk and look for indexed data and fields

1 Solution

agthurber
Explorer

got it to work, looks like i was having trouble locating the source after my initial experiments, so it was a simple mistake, but it was hard to find the cause, there was no obvious signs in the logs and no alerts popped up saying there was a problem finding the input file. Probably just a nubie issue but it would be nice to get some more feedback from splunk while trying to create the configurations needed to get the logs in.

hope this helps someone else along the way.

View solution in original post

agthurber
Explorer

got it to work, looks like i was having trouble locating the source after my initial experiments, so it was a simple mistake, but it was hard to find the cause, there was no obvious signs in the logs and no alerts popped up saying there was a problem finding the input file. Probably just a nubie issue but it would be nice to get some more feedback from splunk while trying to create the configurations needed to get the logs in.

hope this helps someone else along the way.

Get Updates on the Splunk Community!

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...