Hi Guys
This question is not specific maybe but a conceptual.
I am writing an application. This application contains static CSV file including name, regex and tag columns.
What i want is if you install the application it automatically upload this CSV file and maybe make a lookup table from it. Views and Dashboards are ready. But i dont know how to automate uploading CSV and creating lookup table from it
Is there anyone suggest efficient way with en axample? I mean which config file i should use how to use it etc.
I would appreciate for any help
thanks
I have lookup default appserver bin and metadata folder. I put CSV in the lookup folder. All the config files are under default folder. i think i should use transform.conf to automate of taking CSV as lookup once application installed.
Any suggestion is welcome
Have you referred to your transform stanza in props.conf? Something like:
[yoursourcetype]
LOOKUP-transformstanza = transformstanza name OUTPUTNEW regex
Check out the lookup sections of this page: http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Propsconf