https://community.splunk.com/t5/Splunk-Search/default-interval-for-data-sending/m-p/74377#M18746 <P>What's in your environment that makes it a bad idea to send the data as soon as it arrives to the forwarder?</P> Fri, 28 Sep 2012 12:22:16 GMT Ayn 2012-09-28T12:22:16Z https://community.splunk.com/t5/Splunk-Search/default-interval-for-data-sending/m-p/74373#M18742 <P>I am using Universal forwarder to send data to main Splunk instance to monitor files/directories.</P> <P>What is default interval to send data?<BR /> How do I change this interval for x seconds to y seconds?</P> Fri, 28 Sep 2012 10:57:12 GMT https://community.splunk.com/t5/Splunk-Search/default-interval-for-data-sending/m-p/74373#M18742 jangid 2012-09-28T10:57:12Z https://community.splunk.com/t5/Splunk-Search/default-interval-for-data-sending/m-p/74374#M18743 <P>There is no interval. The forwarder sends data as soon as it has anything to send. You should expect some minor delay before you see the data in your index since data needs to move through the various queues in both the forwarder and the indexer, though. The inputs your forwarder is configured with might use some kind of intervals, like scripted inputs or WMI based inputs.</P> Fri, 28 Sep 2012 12:03:27 GMT https://community.splunk.com/t5/Splunk-Search/default-interval-for-data-sending/m-p/74374#M18743 Ayn 2012-09-28T12:03:27Z https://community.splunk.com/t5/Splunk-Search/default-interval-for-data-sending/m-p/74375#M18744 <P>Then how do I configure Splunk Universal forwarder to send data every one hour to main Instance?</P> Fri, 28 Sep 2012 12:17:39 GMT https://community.splunk.com/t5/Splunk-Search/default-interval-for-data-sending/m-p/74375#M18744 jangid 2012-09-28T12:17:39Z https://community.splunk.com/t5/Splunk-Search/default-interval-for-data-sending/m-p/74376#M18745 <P>To achieve that you'd need to use a scripted input that only reads the data once an hour. There's some stuff on it here: <A href="http://splunk-base.splunk.com/answers/59916/can-you-set-a-certain-time-forwarding-occurs">http://splunk-base.splunk.com/answers/59916/can-you-set-a-certain-time-forwarding-occurs</A></P> Fri, 28 Sep 2012 12:21:17 GMT https://community.splunk.com/t5/Splunk-Search/default-interval-for-data-sending/m-p/74376#M18745 Ayn 2012-09-28T12:21:17Z https://community.splunk.com/t5/Splunk-Search/default-interval-for-data-sending/m-p/74377#M18746 <P>What's in your environment that makes it a bad idea to send the data as soon as it arrives to the forwarder?</P> Fri, 28 Sep 2012 12:22:16 GMT https://community.splunk.com/t5/Splunk-Search/default-interval-for-data-sending/m-p/74377#M18746 Ayn 2012-09-28T12:22:16Z https://community.splunk.com/t5/Splunk-Search/default-interval-for-data-sending/m-p/74378#M18747 <P>If the log constantly changes, then it would be expensive to send a TCP traffic every time it changes.</P> Wed, 07 Oct 2015 23:04:46 GMT https://community.splunk.com/t5/Splunk-Search/default-interval-for-data-sending/m-p/74378#M18747 InkerzBrad 2015-10-07T23:04:46Z