Indexing logs as event

danillopavan — Sun, 03 Dec 2017 14:29:46 GMT

Hello all,

I would like to monitor a file that is being changed every 15 minutes (unique file in the directory) and it is a very large log file (almost 100MB ~ 150MB). I have some questions about that:

Is there any way to index just the recent changes and not the entire file? I read something about the followTail setting, however not sure if it is really appropriated;
Index just some lines of the log and not the entire recent changes? Something like: all the recent lines that starts with specific text..Maybe apply here REGEX...
Index the lines of the item 2 as one single event for each repetition... Example the below log file content:

S Sß: (2017120211271200) sending job @>SPOREQ:1597246@DEV:JC15@<'
S 2 pages (OTF) printed in 0 seconds, avg. 0.0 pages per sec
S Timeinfo @>SPOREQ:587821@DEV:DS01@<): 0 1 List ( 0 0 0 0 0 0 )
S Sß: (2017120211271300) ....end job @>SPOREQ:1597246@DEV:JC15@<'
S <-- Job @>SPOREQ:1597246@</1 processed (rc=0) }

Many many many thanks for the support!
Danillo Pavan

Re: Indexing logs as event

woodcock — Sun, 03 Dec 2017 17:16:41 GMT

Check out this app:
https://splunkbase.splunk.com/app/2864/

topic Indexing logs as event in Monitoring Splunk

Indexing logs as event

Re: Indexing logs as event