How to index data from the directory based on the log created date in SPLUNK?

deepthi5 — Mon, 22 Jun 2015 10:14:17 GMT

Hi Team,

I have a couple of logs to be monitored daily from a directory called LOG. The log name is error log.0, error log.1, and so on, where 0 means Sunday , 1 -->Monday etc. After 7 days, the logs will be automatically deleted from the directory.

Can someone suggest the search command to execute this? I have tried error log.* which will index all logs daily (unnecessary action)

Thanks
Deepthi

Re: How to index data from the directory based on the log created date in SPLUNK?

richgalloway — Mon, 22 Jun 2015 11:28:19 GMT

If you use "log.*" Splunk will indeed index all seven logs the first day, but after that should recognize that some files haven't changed and not re-index them.

topic How to index data from the directory based on the log created date in SPLUNK? in Getting Data In

How to index data from the directory based on the log created date in SPLUNK?

Re: How to index data from the directory based on the log created date in SPLUNK?