topic Re: Monitoring a folder in Getting Data In

Monitoring a folder

indikaw — Wed, 09 Jan 2013 01:31:18 GMT

We are talking about the Splunk capability of monitoring any type of logs. I am having a gunieune issue to to monitor Splunk activity on a partucar folder. I got a folder with large number of files in it that I have told Splunk to monitor once. But how do I know when it's started and when it has stopped. Also to make sure Splunk has indexed all of them successfully. This looks to be a simple question. But can anyone has experience on this and appreciate an answer. I have asked this before and didn't hear anything.

Re: Monitoring a folder

Ayn — Wed, 09 Jan 2013 08:56:51 GMT

It's a simple enough question, but not very common because Splunk is most often not used for reading files/directories a single time like that so it's hard to say when it's "done" if it's monitoring a file that's being continuously updated.

That said, you could use the TailingProcessor:FileStatus endpoint to check the status of various monitors. Better yet, use amrit's script that does this for you and makes it look a bit nicer: http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/