topic Re: Monitor splunk file after restart in Monitoring Splunk

Monitor splunk file after restart

ankithreddy777 — Fri, 27 Jul 2018 11:35:27 GMT

On the Splunk docs it is given as

How Splunk Enterprise handles monitoring of files during restarts
When the Splunk server is restarted, it continues processing files where it left off. It first checks for the file or directory specified in a monitor configuration. If the file or directory is not present on start, Splunk Enterprise checks for it every 24 hours from the time of the last restart. The monitor process scans subdirectories of monitored directories continuously

Suppose if I deployed inputs to monitor a file and restarted splunk after deploying and If the monitored file was not created yet. Does splunk enterprise check for that file only after 24 hours to reads the file. What if the file created after few minutes after restart. Will it be ignored until 24 hrs of restart.

Suppose I gave wildcard for file name, Does it behave same. I can see newly created file was read by splunk immediately when it created for wild card file names.

Re: Monitor splunk file after restart

thambisetty — Fri, 27 Jul 2018 12:39:20 GMT

as per the document, during restart ,If the file or directory is not present on start, Splunk Enterprise checks for it every 24 hours from the time of the last restart.

yes, as per the document file will be ignored until next check. not tested.

if you are monitoring the existing directory, newly created file under this monitored directory will be monitored immediately.

Re: Monitor splunk file after restart

ankithreddy777 — Fri, 27 Jul 2018 13:52:00 GMT

How it works , if you use the wild card in file or directory name. such as

[monitor.....././..../abc*

Does the file with name "abcd" which is created after few hours of restart will be ignored until 24 hours? OR Is there any exception for this scenario?

Re: Monitor splunk file after restart

thambisetty — Fri, 27 Jul 2018 13:59:52 GMT

if there is any exception in this scenario , that would be described in the doc.

Re: Monitor splunk file after restart

sudosplunk — Fri, 27 Jul 2018 14:24:36 GMT

Whenever a file is created or modified, splunk will monitor it immediately.