topic "splunk add oneshot" not working in Getting Data In

"splunk add oneshot" not working

vpsmax — Thu, 17 Sep 2020 22:00:46 GMT

Hello.

Trying to test a sourcetype using "oneshot". Although we were able to add raw data using "oneshot" the first time, we are not seeing any subsequent updates. The command we are using is ...

splunk add oneshot /tmp/<filename>.txt -index <indexname> -sourcetype <sourcetypename>

What are the best approaches to troubleshoot "oneshot"?

Regards,
Max

Re: "splunk add oneshot" not working

bdiego_splunk — Thu, 17 Sep 2020 23:05:08 GMT

Hi Max,

Please try:

splunk add oneshot -source /tmp/<filename>.txt -index <indexname> -sourcetype <sourcetypename>

Regards,

-bd-

Re: "splunk add oneshot" not working

ivanreis — Fri, 18 Sep 2020 00:25:23 GMT

Hi Max, use this command to check if the file status of the file has been reset

splunk cmd btprobe -d $SPLUNK_DB/fishbucket/splunk_private_db --file <file> --reset

The response from this command is an indicator that the status for the file has been reset. Again, a restart of the forwarder is required for Splunk to then ingest that file anew.

if this assist you, please upvote.

Re: "splunk add oneshot" not working

anwarmian — Sat, 07 Sep 2024 16:35:51 GMT

We need to remember that Universal Forward does not do index-time parsing, on the other hand a Splunk Enterprise server such as a Heavy Forwarder, Search Head, Deployment server, depoyer, etc does the index-time parsing. Indexers expect that the data that come via another Splunk Enterprise server have the data cooked.