Splunk online course

How to Add Data to Splunk

Learn how to add data to Splunk Enterprise using Upload, Monitor, or Forward, configure parsing and metadata, and verify indexed events in Search.

Splunk Enterprise must receive and index machine data before you can search or analyze it. The onboarding process creates a data input: a configured mechanism through which Splunk collects or receives data.

Splunk organizes indexed records as events. Each event can include metadata such as its source, host, sourcetype, and destination index.

For background, see What Is Splunk, Splunk Home, and What Is an Index.

Choose a Splunk Data Ingestion Method

The Add Data workflow provides three primary methods: Upload, Monitor, and Forward. Select the method according to whether the data is static, continuously available, or produced by distributed systems.

Method — Collection behavior — Typical source — Best use case — Key limitation or consideration

Upload — One-time import — A local file or archive — Demonstrations, investigations, historical imports, and small test datasets — Does not continuously monitor the original file.

Monitor — Ongoing collection — Files, directories, network streams, scripts, or other accessible machine-generated sources — Operational and production data that changes over time — Requires a configured and accessible source.

Forward — Ongoing remote delivery — Data sent by Splunk forwarders — Distributed hosts and remote endpoints — Requires forwarder and receiver connectivity.

Upload

Upload is a web-based, one-time import of an individual file or a compressed collection of files. It is useful when you want to test Splunk with a sample log, analyze a historical file, demonstrate a search, or ingest a small dataset for an investigation.

Upload is not an ongoing collection mechanism. If new records are later added to the original file, Splunk does not automatically collect them through the completed upload.

Monitor

Monitor creates a continuously active input. Splunk watches a configured source for new or changed content and indexes matching data as it becomes available. Monitored inputs can include files, directories, network data streams, scripts, and other machine-generated sources.

Monitoring is generally the right choice for a server log that grows throughout the day or another operational source that must be collected continuously. Unlike Upload, Monitor remains active after the initial configuration.

Forward

Forward receives data transmitted by a forwarder. A forwarder is Splunk software installed on or near a source system. It collects data and sends it to a Splunk receiver.

In this model, the distributed host performs the forwarding role, while Splunk Enterprise performs the receiver, indexing, storage, and search roles. Forwarder-based collection is appropriate when data comes from many remote systems. Learn more in What Are Forwarders, Set Up a Receiver, and Monitor Logs Using Forwarders.

Upload a File Through Splunk Web

The following example imports a local test log one time and then confirms that its events are searchable.

  1. Open the Splunk home page and select Add Data. See Access Splunk Web Interface if you need help signing in.
  2. Choose Upload as the data input method.
  3. Select a local file. Depending on the Splunk version and workflow, you can also select a compressed archive containing multiple files.
  4. Wait for the file transfer to finish, then continue to the parsing and source type step.
  5. Inspect the parsing preview before submitting the input.
  6. Set the host metadata and choose the destination index.
  7. Review the file, parsing choices, host, and index, then submit the configuration.
  8. Open Search after completion and verify the newly indexed events.

Sourcetype and Event Parsing

A sourcetype describes the structure and format of incoming data. Splunk uses it during indexing to interpret records, identify event boundaries, and extract timestamps. A suitable sourcetype helps Splunk recognize the data consistently.

Review automatic detection

During Upload, Splunk previews the expected parsing result and may automatically detect a built-in sourcetype definition. Retain the detected sourcetype when the preview matches the file format and the events look correct. If the format is different, choose a more suitable existing sourcetype rather than accepting an inaccurate detection.

Validate event boundaries and timestamps

Event breaking is the process of determining where one event ends and the next begins. A parsing error can merge several log records into one event or split one record into multiple events.

Timestamp extraction is the process of finding the event time in the incoming data. Check that Splunk is using the intended date and time field, especially when the file contains several timestamps or uses a nonstandard format.

Use the parsing controls and advanced options when needed to adjust event boundaries, timestamp extraction, or other parsing behavior. Before continuing, confirm that:

  • Each visible log record is a separate event.
  • No event contains unrelated records merged together.
  • Events are not split in the middle of a record.
  • Timestamp values represent the actual event times.
  • The visible field and event layout looks consistent with the source data.

Input Settings and Event Metadata

Host

Host identifies the machine or logical system associated with an event. When uploading a file, assign a hostname or IP-based value that accurately represents where the data originated. This is especially important when the file was copied to your computer from another system.

An incorrect host value can make searches, reports, and investigations associate events with the wrong system.

Source

Source identifies the specific input path, file, stream, or origin from which Splunk collected an event. For an uploaded file, the source commonly reflects the uploaded file and its input context.

Index

An index is a named storage destination for events. Indexes support data separation, access controls, retention practices, and efficient searching. Choose the destination according to your organization's data ownership, security, and retention policies.

If a suitable index does not exist, coordinate with an administrator or review Create An Index before onboarding the data.

Review and Submit

Before completing the Upload workflow, review all of the following:

  • The selected file or compressed collection.
  • The detected or manually selected sourcetype.
  • The event boundaries shown in the parsing preview.
  • The extracted timestamps.
  • The assigned host value.
  • The source information.
  • The target index.

Submit the configuration only after the preview and metadata match your expectations. Submission creates the input and indexes the uploaded content.

Verify the Ingested Data

After submission, open Search. You can use the Search app or the option offered at the end of the ingestion workflow. See Launch Search App for the navigation path.

Start with the selected index and a broad time range:

index=<target_index>

Replace the placeholder with the index selected during onboarding. After confirming that events are present, narrow the search with metadata filters:

index=<target_index> host=<assigned_host>
index=<target_index> sourcetype=<selected_sourcetype>
index=<target_index> source=<uploaded_source>

Confirm the expected event count, timestamps, event boundaries, and formatting. Searching the index without restrictive filters is useful when troubleshooting. Also use an all-time or otherwise broad time range if the source timestamps may fall outside the default search window.

Upload Workflow Configuration Checklist

Stage — Decision or action — What to validate

File selection — Select the local file or archive — The intended content transferred successfully.

Parsing and sourcetype — Accept automatic detection or select a suitable definition — Events, boundaries, timestamps, and visible layout are correct.

Host assignment — Enter the hostname or IP-based host value — The value represents the true data origin.

Index selection — Choose the storage destination — The index matches organizational separation and retention practices.

Review — Inspect all configuration choices — File, parsing, host, source, and index are correct.

Search verification — Search the assigned index — Expected events, timestamps, and metadata are present.

Choosing the Method: Practical Scenarios

  • Import a static log file for analysis: Choose Upload because the content is collected once and does not need continuous observation.
  • Continuously collect a server log: Choose Monitor because Splunk must keep reading new events from a source that changes over time.
  • Collect data from remote endpoints at scale: Choose Forward because forwarders can send events from distributed systems to Splunk.

Troubleshooting Data Ingestion

Uploaded events cannot be found in Search

  • Search the selected index without restrictive host, source, or sourcetype filters.
  • Use an all-time or appropriately broad time range.
  • Confirm the index selected during Upload.
  • Check the configured host, source, and sourcetype values.

Common causes include searching the wrong index, excluding the event timestamps with the time range, or applying metadata filters that do not match the uploaded data.

Records are merged or split incorrectly

Review the ingestion preview. If automatic detection is unsuitable, select a more appropriate sourcetype and adjust event-breaking settings. Recheck the preview before submitting.

Events have incorrect timestamps

Inspect the timestamp values in the preview. The detected pattern may be selecting the wrong date or time, or the source format may require a parsing adjustment. Correct the timestamp options and use a broad time range when verifying the resulting events.

New records added to the original file do not appear

This is expected after a one-time Upload. Upload the updated content again if another one-time import is appropriate. For ongoing collection, configure Monitor or use a forwarder-based workflow.

Events are associated with the wrong system

Review the host setting in the input configuration. Replace an unsuitable default with a hostname or IP value that accurately represents the system that produced the data.

Key Exam Notes

  • Splunk must index data before it can be searched and analyzed.
  • Upload is a one-time import; Monitor is continuous collection; Forward receives data from forwarders.
  • A sourcetype describes data structure and controls important parsing behavior during indexing.
  • Always validate event breaking and timestamp extraction in the preview.
  • Host identifies the producing system, source identifies the input origin, and index identifies the storage destination.
  • Verify ingestion by searching the selected index and checking event count, time, formatting, and metadata.