Hello. I cannot find a solution to this one here... I have logs in one Splunk instance. I've exported them to CSV and want to perform a one-time ingest of that CSV into a new on-prem Splunk Enterprise instance. I have the CSV and can import it. However, I can't figure out how to preserve each row/event's original 'host', timestamp, and 'sourcetype' entry. When I do the import, it records the 'host' as the Splunk indexer, and the timestamp as the date of the import, which makes sense but is not the desired behavior. Here is a sample row of the CSV: _time,host,index,source,sourcetype
2024-11-19T11:36:05.000-0500,host1.example.com,test-index,/var/log/messages,syslog
2024-11-19T11:36:05.000-0500,host2.example.com,test-index,/var/log/messages,syslog I removed the _raw column, but I can include it if necessary. How do I import these events while preserving the event time, host, and sourcetype fields? Is this even possible? I looked around here and can't find anyone with this scenario. Thank you in advance!
... View more