On the map issue discussed above, when I run a map command after the initial importutl code it doesn't seem to pick up the values. e.g. | importutil format=splunk http http://mysite/mycsv.csv | multikv | table EventValueFilter, Duration, Earliest, Limit | map [search source=MySource $EventValueFilter$ $Limit$ | stats avg(Timing) as Timing by TransactionName | where Timing >= $Duration$] maxsearches=99 | fields TransactionName, Timing It returns 9 rows with no values for either TransactionName or Timing shown. The initial import CSV contains 9 records. ... View more

paddy, good luck. If this ends up working for you and if you have a moment please rate the app on splunkbase. Thanks. Good Luck! ... View more

Ayn, this is what I was looking for. Thanks so much. ... View more

One option I was considering... would appreciate some thoughts on this. What if we created a second Index and moved all data older than 90 days into the second Index. Then all searches could just look like "(index=primary OR index=secondary) earliest=-180d blah blah blah". Is it poossible to pin certain Indexes to only certain indexer nodes? ... View more

There is a new splunkbase app called "importutil". It lets you import csv files (or any input) from an http url via the splunk search command line. Also works for ftp. sftp is experimental. http://splunk-base.splunk.com/apps/69078/importutil Here is an ftp example. Pulling from the bureau of labor stats: |importutil ftp ftp://ftp.bls.gov/pub/time.series/ce/ce.data.102.WeeklyEarningsHist | multikv | table series_id, year, period, value, footnote_codes Here is an example that imports data from the federal reserve economic data website: |importutil http http://research.stlouisfed.org/fred2/data/PAYEMS.csv | multikv | table DATE, VALUE ... View more

There is a README.txt file in the app that contains instructions. Now that you have the app installed, you will need to create an input to start the FTP server: Navigate to "Settings » Data Inputs" at the menu at the top of Splunk's user interface. Click "FTP" Click "New" to make a new instance of an input Make sure that the path that you are serving the files from exists. See https://raw.githubusercontent.com/LukeMurphey/splunk-ftp-receiver/master/src/README.txt for the full details. ... View more