Getting Data In

How to automatically upload CSV files to Splunk monthly?

akawacz
Path Finder

Hello,

I would like to upload automatically CSV files in monthly manner. Data should be normally indexed and go to specific sourcetypes (not talking here about lookup tables)

What would be the best way to do that ?

I was thinking here about - http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Extractfieldsfromfileheadersatindextime

Thank you

0 Karma
1 Solution

woodcock
Esteemed Legend

You do not need to use splunk facilites to update CSV files. You can create a monitor stanza in inputs.conf or create a lookup file in transforms.conf and do this one time and after that use any other process (ftp from outside, cron job on the Search Head) to update the file.

View solution in original post

woodcock
Esteemed Legend

You do not need to use splunk facilites to update CSV files. You can create a monitor stanza in inputs.conf or create a lookup file in transforms.conf and do this one time and after that use any other process (ftp from outside, cron job on the Search Head) to update the file.

akawacz
Path Finder

This sounds good.

Will be possible to pick source type ? (becase i have different files to upload)

0 Karma

woodcock
Esteemed Legend

Yes, and if this is a one-time upload of stuff, you should look into using the add oneshot command:

http://docs.splunk.com/Documentation/Splunk/6.3.0/Data/MonitorfilesanddirectoriesusingtheCLI

0 Karma

ChrisG
Splunk Employee
Splunk Employee

You can set things up to monitor a file or directory. You could automate your file update in that location and then Splunk Enterprise would update it. See Monitor files and directories with Splunk Web, also in the Getting Data In manual. Is that the kind of thing you're looking for?

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...