I'm trying to add a .csv file via Data Inputs. Here are the steps I'm taking for this (v6.4):
Ran the following search:
source="C:\\Users\\User1\\Downloads\\SearchReport.csv" host="USABCD123456" index="siam" sourcetype="csv"
NO DATA, but the file is listed under "Files & Directories"
Any help is much appreciated!
Data Preview does not work on "Continously Monitor". You need to select "One Time", verify your settings, save your sourcetype and before you finalize, go back and change to "Continously Monitor"
Hi @sundareshr. Thanks for responding!
I tried the "Index Once" option, with all other settings as stated above and I'm still not able to preview the data before moving on to configuring the Input Settings.
When I continue to submit the new data input, there are no results returned. Going back to change to "Continuously Monitor", I don't even see my file listed.
Please advise.
Check the splunk logs for any errors or warning
index=_internal sourcetype=splunkd error OR warn
index=_internal.... returns nothing.
Since, I'm doing this from my FREE local Splunk instance, does this matter? It's a simple .csv sample file.