https://community.splunk.com/t5/Getting-Data-In/How-do-I-use-activate-the-short-term-bulk-loading-using-the/m-p/401544#M95122 <P>Hi all, Currently I am using the Splunk Free version. However, i would like to import the splunk bots dataset into the splunk server to . They are 6GB large. </P> <P>According to splunk free documentation on <A href="https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/MoreaboutSplunkFree">https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/MoreaboutSplunkFree</A>,</P> <P>"Is Splunk Free for you?<BR /> Splunk Free is designed for personal, ad hoc search and visualization of IT data. You can use Splunk Free for ongoing indexing of small volumes (&lt;500 MB/day) of data. Additionally, you can use it for short-term bulk-loading and analysis of larger data sets--Splunk Free lets you bulk-load much larger data sets up to 3 times within a 30 day period. This can be useful for forensic review of large data sets."</P> <P>How do I use/activate the short term bulk loading? I tried to import the dataset via installing a app, but received the error message of maximum size is 500mb. </P> Sun, 02 Jun 2019 03:19:06 GMT yihan 2019-06-02T03:19:06Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-use-activate-the-short-term-bulk-loading-using-the/m-p/401544#M95122 <P>Hi all, Currently I am using the Splunk Free version. However, i would like to import the splunk bots dataset into the splunk server to . They are 6GB large. </P> <P>According to splunk free documentation on <A href="https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/MoreaboutSplunkFree">https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/MoreaboutSplunkFree</A>,</P> <P>"Is Splunk Free for you?<BR /> Splunk Free is designed for personal, ad hoc search and visualization of IT data. You can use Splunk Free for ongoing indexing of small volumes (&lt;500 MB/day) of data. Additionally, you can use it for short-term bulk-loading and analysis of larger data sets--Splunk Free lets you bulk-load much larger data sets up to 3 times within a 30 day period. This can be useful for forensic review of large data sets."</P> <P>How do I use/activate the short term bulk loading? I tried to import the dataset via installing a app, but received the error message of maximum size is 500mb. </P> Sun, 02 Jun 2019 03:19:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-use-activate-the-short-term-bulk-loading-using-the/m-p/401544#M95122 yihan 2019-06-02T03:19:06Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-use-activate-the-short-term-bulk-loading-using-the/m-p/401545#M95123 <P>Hi @yihan, what do you mean tried importing the dataset via installing an app ? Did you setup a monitor on the required files via inputs.conf or GUI ?</P> Sun, 02 Jun 2019 12:18:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-use-activate-the-short-term-bulk-loading-using-the/m-p/401545#M95123 DavidHourani 2019-06-02T12:18:31Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-use-activate-the-short-term-bulk-loading-using-the/m-p/401546#M95124 <P>Hi @yihan </P> <P>How did you input the log file? If you are uploading with Splunk WebUI, it is failing due to HTTP file transfer size limitation. It is not a license limitation.<BR /><BR /> When importing logs larger than 500MB, split the file so that one file is less than 500MB. Then try uploading from WebUI.</P> Sun, 02 Jun 2019 12:30:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-use-activate-the-short-term-bulk-loading-using-the/m-p/401546#M95124 soskaykakehi 2019-06-02T12:30:31Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-use-activate-the-short-term-bulk-loading-using-the/m-p/401547#M95125 <P>Other option is using input monitor or oneshot command.</P> Sun, 02 Jun 2019 12:32:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-use-activate-the-short-term-bulk-loading-using-the/m-p/401547#M95125 soskaykakehi 2019-06-02T12:32:42Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-use-activate-the-short-term-bulk-loading-using-the/m-p/401548#M95126 <P>The dataset given from splunk for Bots SOC is given as an app to import: <A href="https://github.com/splunk/botsv1">https://github.com/splunk/botsv1</A></P> Sun, 02 Jun 2019 15:20:15 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-use-activate-the-short-term-bulk-loading-using-the/m-p/401548#M95126 yihan 2019-06-02T15:20:15Z