Getting Data In

Requests.Post CSV File contents into Splunk using HEC

vkannampuzha
Explorer

Hi all,

I'm having issues with using the requests library in python to send the contents of a csv file to Splunk. I've managed to do it for json files and can even convert the csv contents to a json format and post it on splunk successfully. I'm wondering if there was a way to do a requests.post and and send the csv file whilst keeping the csv format rather than changing to a json format.

Here is the code I am using to post json content to splunk:

with open('file.csv') as f:
    reader = csv.DictReader(f)
    file_contents = list(reader)

headers = {
            'Authorization': 'Splunk 'token number''  
        }

data = {'sourcetype': '_json', 'event': file_contents}  

try:
    response = requests.post('http://localhost:8088/services/collector',
                             headers=headers, data=json.dumps(data),
                             verify=False)  
except Exception as e:
    print(str(e))

Thanks!

0 Karma
1 Solution

vkannampuzha
Explorer

After a bit of research, it turns out I can't actually send through data that has a csv format. According to the splunk documentation, I can only send through json or raw data.

View solution in original post

0 Karma

vkannampuzha
Explorer

After a bit of research, it turns out I can't actually send through data that has a csv format. According to the splunk documentation, I can only send through json or raw data.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...