topic Moving away indexed files after indexing in Getting Data In

Moving away indexed files after indexing

wsw70 — Wed, 12 Dec 2012 08:12:33 GMT

Hello,

I index files in a directory. The files are normally created for the sake of being indexed and do not change after indexing (in other words, they are not updated - once created they are frozen).

I noticed that they are sometimes reindexed (not sure why but I can wildly guess they were "touch"-ed (linux speaking) or otherwise modified (their attributes, not content), which triggered a reindexation).

Is there a way to instruct splunk to move then to another predefined directory after they have been indexed?
Alternatively: make it so that splunk would index them only once, no matter the changes (I know that this is possible for a single file but apparently not for a monitored directory)

The first solution (move them away) would be ideal.

Thank you.

Re: Moving away indexed files after indexing

Ayn — Wed, 12 Dec 2012 08:43:40 GMT

Splunk has no mechanisms for performing file-system operations like that (other than reading files, of course).

You should check splunkd.log to see what causes Splunk to reindex files. Even if files are touched, Splunk should not reindex them because it keeps a CRC checksum and read offset to see if a file really has changed and if so where it should start reading.

Re: Moving away indexed files after indexing

wsw70 — Wed, 12 Dec 2012 09:32:03 GMT

Thanks. I will have a closer look at splunkd.log as there are interesting messages there anyway (never had a look before)