topic Re: How long to wait after &quot;splunk add oneshot&quot; before doing searches? in All Apps and Add-ons https://community.splunk.com/t5/All-Apps-and-Add-ons/How-long-to-wait-after-quot-splunk-add-oneshot-quot-before-doing/m-p/83947#M70929 <P>One way would be to query the tailing processor (<A href="https://localhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus">https://localhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus</A>). Here is more detail that links to a python script that shows how to do this: <A href="http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/">http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/</A></P> Mon, 05 Mar 2012 04:32:32 GMT bwooden 2012-03-05T04:32:32Z How long to wait after "splunk add oneshot" before doing searches? https://community.splunk.com/t5/All-Apps-and-Add-ons/How-long-to-wait-after-quot-splunk-add-oneshot-quot-before-doing/m-p/83946#M70928 <P>[All this is using CLI]</P> <P>I do add oneshot for 3 log files one after the other.<BR /> Then I do an immediate search on the last log file which fails.</P> <P>If I wait for a few seconds, the search works. My question is, is there a way for me to deterministically wait before beginning searches? I want to avoid adding sleeps as they may not work depending on how large the log file is.</P> <P>Thanks!</P> Mon, 05 Mar 2012 01:45:25 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-long-to-wait-after-quot-splunk-add-oneshot-quot-before-doing/m-p/83946#M70928 paragcisco 2012-03-05T01:45:25Z Re: How long to wait after "splunk add oneshot" before doing searches? https://community.splunk.com/t5/All-Apps-and-Add-ons/How-long-to-wait-after-quot-splunk-add-oneshot-quot-before-doing/m-p/83947#M70929 <P>One way would be to query the tailing processor (<A href="https://localhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus">https://localhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus</A>). Here is more detail that links to a python script that shows how to do this: <A href="http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/">http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/</A></P> Mon, 05 Mar 2012 04:32:32 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-long-to-wait-after-quot-splunk-add-oneshot-quot-before-doing/m-p/83947#M70929 bwooden 2012-03-05T04:32:32Z