step by step, adding a new csv datasource

[agthurber]

I'm was missing something really simple when trying to set up a new datasource, so i put these steps together as i followed the documentation and hope they can help someone out. If I got anything wrong please correct me but this is how i got it working for my needs

step 1: create the index "myindex", i am doing this from inside of the splunk GUI, give it a name and click save

Step 2: stop splunk so i can manually edit/create the conf files needed to perform the desired functions

step 3: create/append $SPLUNK_HOME/etc/apps/search/local/inputs.conf with the following values

[monitor://$SPLUNK_HOME/input/myfile.csv]
host=myhost
source=mysource
sourcetype=mysourcetype
index=myindex

step 4: create/append $SPLUNK_HOME/etc/apps/search/local/props.conf

[source::mysource]
REPORT-mysource = mysource_csv

step 5: create/append $SPLUNK_HOME/etc/apps/search/local/transforms.conf

[mysource_csv]
DELIMS = ","
FIELDS = "field1","field2","field3","field4","field5"

step 6: start splunk and look for indexed data and fields

[agthurber · Accepted solution]

got it to work, looks like i was having trouble locating the source after my initial experiments, so it was a simple mistake, but it was hard to find the cause, there was no obvious signs in the logs and no alerts popped up saying there was a problem finding the input file. Probably just a nubie issue but it would be nice to get some more feedback from splunk while trying to create the configurations needed to get the logs in.

hope this helps someone else along the way.