topic Re: Adding text file into splunk in Getting Data In

Adding text file into splunk

prathapkcsc — Thu, 06 Apr 2017 17:59:53 GMT

I have a script containing ip and value.
Sh basic.sh>>sample.out
Know to get the logs i need to add this sample.out file to splunk like
/opt/splunkforwarder/bin/splunk add monitor sample.out.
Then i the files will comes into splunk..
But the problem is i want that script to be run everyone one hour..everytime adding that output file to splunk is not a good idea..Is there any way to schedule automatically or monitor that output file all the time...
Can anyone help me...

Thank you

Re: Adding text file into splunk

dflodstrom — Thu, 06 Apr 2017 19:27:27 GMT

You can run this script as a scripted input that kicks off on a given cron schedule. Or, if you've scheduled this script to run locally and write to sample.out as you indicated you can have Splunk read sample.out using a monitor input stanza.

Getting Data Into Splunk

Monitoring Files and Directories

Re: Adding text file into splunk

DalJeanis — Thu, 06 Apr 2017 19:38:22 GMT

Are you saying you want to add it once, and never again?

Or are you saying you want the new data to be loaded every hour when it runs?

Re: Adding text file into splunk

prathapkcsc — Thu, 06 Apr 2017 20:12:46 GMT

Yes..I want to add that script output file sample.out once to the splunk path...
I want to avoid this thing
"/opt/splunkforwarder/bin/splunk add monitor sample.out"..
Splunk has to monitor changes in that outfile automatically

Re: Adding text file into splunk

prathapkcsc — Fri, 07 Apr 2017 04:47:21 GMT

[monitor://$SPLUNK_HOME/var/log/splunk]

can i add that output file to this path..

Re: Adding text file into splunk

prathapkcsc — Fri, 07 Apr 2017 04:49:05 GMT

"/opt/splunkforwarder/bin/splunk add monitor filename"
i want to avoid this above thing everytime.
can you give me the correct solution
Thank you

Re: Adding text file into splunk

sduff_splunk — Fri, 07 Apr 2017 06:20:47 GMT

Splunk will automatically monitor changes in that outfile automatically!

You can either append data to the file, or create a new file each time, but Splunk will get updates made to it. You just need to use a monitor clause that you've already done with that add monitor command (check etc\system\local\inputs.conf, it should be listed there).

Re: Adding text file into splunk

prathapkcsc — Fri, 07 Apr 2017 06:28:22 GMT

[monitor://$SPLUNK_HOME/var/log/splunk]

this one right?

Re: Adding text file into splunk

prathapkcsc — Fri, 07 Apr 2017 06:29:41 GMT

if i place my output file inside this path SPLUNK_HOME/var/log/splunk...
wiill it detect the changes automatically?

Re: Adding text file into splunk

sduff_splunk — Fri, 07 Apr 2017 06:34:22 GMT

Add the following to etc\system\local\inputs.conf

[monitor://path/to/your/file/outfile]
index=main

Refer to http://docs.splunk.com/Documentation/Splunk/6.5.3/Admin/Inputsconf and http://docs.splunk.com/Documentation/Splunk/6.5.3/Data/WhatSplunkcanmonitor.

Re: Adding text file into splunk

prathapkcsc — Tue, 29 Sep 2020 13:34:39 GMT

[monitor://$SPLUNK_HOME/var/log/splunk/outputfile]
index=my_log_index_name

Thats it right??

Re: Adding text file into splunk updated URL

venkataakhilesh — Wed, 20 Mar 2024 01:11:56 GMT

https://docs.splunk.com/Documentation/Splunk/9.2.0/Data/WhatSplunkcanmonitor