If you haven't reviewed the Splunk tutorial, I recommend it: Splunk Tutorial. Part 3 talks about getting data into Splunk.
Specifically, you just need to specify a monitor stanza in inputs.conf. The stanza should reference the file(s) that you want to forward.
More info at Edit inputs.conf in the Getting Data In manual.
I have edited my inputs.conf as follows:
[monitor:///home/logs/xyz]
whitelist = .*$
recursive = true
But I still get:
TailingProcessor - Ignoring file '/home/logs/xyz/abc.xls' due to: binary
Thank you so much for your help! I'll give it a try!
If you haven't reviewed the Splunk tutorial, I recommend it: Splunk Tutorial. Part 3 talks about getting data into Splunk.
Specifically, you just need to specify a monitor stanza in inputs.conf. The stanza should reference the file(s) that you want to forward.
More info at Edit inputs.conf in the Getting Data In manual.
Set inputs.conf to this
[monitor:///home/logs/xyz]
sourcetype=myCSV
You don't need the other settings. I do think you should assign a sourcetype. But since Splunk thinks the file is binary, you will need props.conf as follows:
[myCSV]
NO_BINARY_CHECK = true
Now, if the file is actually binary, you will get gibberish in Splunk. But if the file really is in CSV format, it should index properly. You might want to set some other properties in props.conf as well, but this should get you started.