topic Re: Index Log file on demand in Getting Data In

Index Log file on demand

SirHill17 — Mon, 28 Sep 2020 20:16:11 GMT

Hi,

To avoid too much data collection, I would like Splunk to only index a log file following a manual action like clicking on a cell in the search result.

I have already set up the index on the indexer, the class on the deployment-server, but currently it collects every file logs.

i.e.:

2015-06-15 13:40:13 hostname ERROR get_details gf_ServerDetails failed /apps/user/tmp/xxxxxxx.tmp.get_details

So what I would like is when clicking on the file name, Splunk goes to read the file and display the result.

Not sure if my request is clear enough. Do not hesitate to request more details.

Thanks for your help.

Regards,

Cyril

Re: Index Log file on demand

yannK — Mon, 15 Jun 2015 12:30:12 GMT

The indexers/search-head have no control on the forwarders, and also have no knowledge of the list of files available. So you cannot search on log files that have not yet be indexed.

So your question looks more like an Enhancement Request.

Tracks to try manually :

use the oneshot CLI command to index a file on demand ( on the forwarder)
to get a list of files on a remote forwarder. try a scripted input doing a simple dir/ ls with file timestamps on a regular basis
maybe a deployment server could be used to create specific inputs. but will not be great if you have many inputs to handle and clear afterward.

Re: Index Log file on demand

SirHill17 — Mon, 15 Jun 2015 12:36:46 GMT

The oneshot command could be useful, I will try that.

Thanks.