topic Re: Import OLD event logs from backup drive in Getting Data In

Import OLD event logs from backup drive

berniefieldhous — Tue, 21 Sep 2010 06:37:34 GMT

Hi...

I'm trying to import 'thousands' of old event logs into Splunk to setup a searchable database....

I can enter them in one at a time using the "Data Input > Files & Directories > upload a file" but this would take forever....

Is there any other way to feed in all this data into splunk ????

Cheers Bernie

Re: Import OLD event logs from backup drive

Genti — Tue, 21 Sep 2010 06:52:40 GMT

Where are these thousands of events located. It seems like they are in a drive, can you not include the main directory where these logs are instead of doing it one by one? i.e. instead of doing
[monitor:///backup/logs/a.log] do [monitor:///backup/logs/] or better yet, [monitor:///backup/]

Re: Import OLD event logs from backup drive

Genti — Tue, 21 Sep 2010 06:54:52 GMT

in other words, do not use one time uploading but use monitoring stanzas. More info here: http://www.splunk.com/base/Documentation/4.1.5/admin/MonitorFilesAndDirectories

Re: Import OLD event logs from backup drive

gkanapathy — Tue, 21 Sep 2010 07:54:14 GMT

Depending what you're doing, it may not be a bad idea to script it with the splunk add oneshot commmand. The command is inexplicably barely documented in the official docs, but several examples exist on answers.splunk.com.