All Apps and Add-ons

Where are the imported CSV located on linux?

mhammett01
New Member

Trying to have a CSV sent every evening probably use a schedule job to update. Using UF to monitor a folder doesnt seem to work, unless someone has been able to do that. Any assistance would be awesome. Cheers!

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mhammett01,
It's not clear why you tagged "Lookup File Editor", the csv file to monitor is on a Universal Forwarder and must be indexed, is it correct?

let me understand:

  • you have a Universal Forwarder installed on a Linux Server,
  • on this server you have a csv to monitor,
  • you want to monitor this file that's updated every day.

I can imagine that your UF are sending logs to Splunk Server so there aren't connection problems, you can simply test this using this search on your Splunk Server (if you have a stand-alone server) or on a Search Head (if you have a Distributed search):

index=_internal host=my_host

If you have results, connection is ok, otherwise you have to test the connection.

So you have to create an Add-On that contains a file called inputs.conf.
Have you a Deployment Server?
So deploy the Add-on on the Universal Forwarder manually or using the Deployment Server.

Anyway, in inputs.conf file there's a dedicated stanza like this:

[monitor:///my_path/my_file.csv]
index=my_index
disabled=0
sourcetype=my_sourcetype

If the name contains the date (e.g. my_file_2019-11-12.csv) you can use:

[monitor:///my_path/my_file*.csv]

In this way you have the input processor to take the file (remember that if you manually deploy the Add-On you have to restart Splunk on Universal Forwarder.

Put attention to the rights on the file: the user running splunkd process must be enabled to read the file.

Ciao.
Giuseppe

0 Karma

mhammett01
New Member

And.....nevermind......went to setting>lookup>Lookup table files

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...