Getting Data In

pushing data to new csv

kavyamohan
Explorer

I have a csv where there are 5 columns and the number of rows is 1000. I have indexed that csv as continuous monitoring. If a new row is added into the same csv it should be automatically pushed to new csv which I have created in Splunk. this can be done based on the any calculation. Is this possible?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hikavyamohan,
you have a continuous monitoring, so the new row is read and indexed by Splunk, to add this row to your csv you have two choices:

  • override the csv with all the results of your search,
  • add only the new row.

The first choice is the easiest because you have to run your search and use the command outputlookup at the end (see https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/Outputlookup ).

The second requires that you filter the results of your search using the existing csv.

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hikavyamohan,
you have a continuous monitoring, so the new row is read and indexed by Splunk, to add this row to your csv you have two choices:

  • override the csv with all the results of your search,
  • add only the new row.

The first choice is the easiest because you have to run your search and use the command outputlookup at the end (see https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/Outputlookup ).

The second requires that you filter the results of your search using the existing csv.

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...