topic How can I monitor a filepath effectively? in Monitoring Splunk

How can I monitor a filepath effectively?

kymenope — Mon, 10 Jul 2023 16:10:14 GMT

I have been attempting to add a file path in data inputs as well as in the inputs.conf file as a "monitor". Each time I implement this Splunk ingestion latency spikes to over 300ms and the service becomes effectively unusable.

My intention is to monitor file additions, deletions, and modifications within a specific filepath.

Any ideas?

Re: Monitoring a filepath effectively

inventsekar — Fri, 07 Jul 2023 21:45:01 GMT

the ingestion latency of 300 milli seconds

you meant to say, the 300 MS is a huge delay? may we know what delay you are expecting? pls let us know more details about the requirements, so that we can understand it and suggest you a solution. thanks.

Best Regards,
Sekar

my youtube channel for Splunk Newbie Learnings
https://www.youtube.com/@SiemNewbies101/videos

Re: Monitoring a filepath effectively

kymenope — Fri, 07 Jul 2023 21:49:40 GMT

once I enable the data input I am unable to use Splunk whatsoever due to this ingestion latency.

I have assigned the inputs a sourcetype but querying for said search type always returns no results.

Re: Monitoring a filepath effectively

inventsekar — Fri, 07 Jul 2023 21:56:09 GMT

maybe you should provide us more details pls..

1) the UF ... linux or win..

2) do you have HF or not

3)the indexers... is it basic single indexer or you have clusters

4)did you do any upgrades recently on the indexer(s)?!?!

5) is it regular log file data onboarding or is it scripted input or HEC or something else..