topic Re: Can Splunk index the complete folder? If yes, how can we achieve this? in Splunk Search

Can Splunk index the complete folder? If yes, how can we achieve this?

kratikaj07 — Wed, 06 Aug 2014 08:43:47 GMT

Can Splunk index the complete folder? If yes, how can we achieve this?

Re: Can Splunk index the complete folder? If yes, how can we achieve this?

strive — Wed, 06 Aug 2014 09:11:17 GMT

do you mean all the log files present in a folder?

Re: Can Splunk index the complete folder? If yes, how can we achieve this?

kratikaj07 — Wed, 06 Aug 2014 09:13:59 GMT

Yes..I mean to say all log file present in a folder so instead of going and uploading each file.Is there any way to index complete folder in one shot?

Re: Can Splunk index the complete folder? If yes, how can we achieve this?

strive — Wed, 06 Aug 2014 09:15:18 GMT

from splunk documentation of inputs.conf file

[monitor://<path>]  
* This directs Splunk to watch all files in <path>.   
* <path> can be an entire directory or just a single file.  
* You must specify the input type and then the path, so put three slashes in your path if you are starting   
at the root (to include the slash that goes before the root directory).

http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/inputsconf

Re: Can Splunk index the complete folder? If yes, how can we achieve this?

strive — Wed, 06 Aug 2014 09:19:53 GMT

You can use [batch://] for large archives of historic data. See, BATCH ("Upload a file" in Splunk Web): section.

Re: Can Splunk index the complete folder? If yes, how can we achieve this?

kratikaj07 — Wed, 06 Aug 2014 09:19:58 GMT

Ok..Thanks for the quick response..I have one more question is it possible using Splunk Web?

Re: Can Splunk index the complete folder? If yes, how can we achieve this?

strive — Wed, 06 Aug 2014 09:25:10 GMT

Using splunk web you can upload zip file containing your log files.
Splunk Enterprise recognizes the following archive filetypes: tar, gz, bz2, tar.gz, tgz, tbz, tbz2, zip, and z

Re: Can Splunk index the complete folder? If yes, how can we achieve this?

kratikaj07 — Wed, 06 Aug 2014 09:38:10 GMT

I am getting error when I am uploading zip file like this:

Unable to process the file : Cannot preview archive file.

Re: Can Splunk index the complete folder? If yes, how can we achieve this?

strive — Wed, 06 Aug 2014 10:02:51 GMT

Can you Skip Preview and try. Choose Skip Preview option and index files.
I have indexed archive files and it works.

Splunk Enterprise decompresses archive files before it indexes them. It can handle these common archive file types: tar, gz, bz2, tar.gz, tgz, tbz, tbz2, zip, and z.
If you add new data to an existing archive file, Splunk Enterprise will re-index the entire file, not just the new data in the file. This can result in duplication of events.

See this link: http://docs.splunk.com/Documentation/Splunk/6.1.2/Data/MonitorFilesAndDirectories

Re: Can Splunk index the complete folder? If yes, how can we achieve this?

kratikaj07 — Wed, 06 Aug 2014 11:34:56 GMT

Thanks.It works with "Skip Preview" option.