Splunk Search

How to onboard csv files using Monitor with specific requirements?

rajim
Path Finder

I have .csv file which would be on-boarded into Splunk using Monitor. It has two specific requirements as below:

  1. The first 16 lines will be ignored.
  2. The file will be updated once in a day. The whole file will be refreshed. But the refreshed file will contain few new or modified records. So I only have o consider those records for uploading into Splunk in each day.

So, can anyone please help me how to
1. write the inputs.conf, props.conf or transforms.conf(if require)?
2. how to write the field extractor in Search Head?

Thanks in advance.

0 Karma

deepashri_123
Motivator

Hey@rajim,

For the second point splunk will take care by itself.
Refer this link:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Monitorfilesanddirectories

For the first point if you want the 17th line to be your header than add following to your props:
HEADER_FIELD_LINE_NUMBER = 17
CHECK_FOR_HEADER=true

Let me know if this helps!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...