Dashboards & Visualizations

getting file logs

henrytran
Engager

Hello,

I am working on getting the logs into a dashboard. Files are sitting in the source a 2 minutes and will be moved to another server after 2 minutes time frame. my concern is if there is a script pull the logs within the time frame.

Thanks in advance

 

Henry

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @henrytran,

I think that an UF can read 50,000 linea in 2.5 minutes, but to be sure, you can do a test.

If your UF is too slow, you can copy the files in another folder, use it for reading and delete files after, but I don't think that's necessary.

Ciao.

Giuseppe

 

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @henrytran,

if you have a Universal Forwarder on the server where files are stored, it reads the logs every 30 second (by default but it's configurable), so your files are read before they move.

So you don't need a script.

A script could help if your cannot install a UF on that server, but this isn't a Splunk question, it's a Linux question.

Ciao.

Giuseppe

0 Karma

henrytran
Engager

I am clarifying that how quick the Universal Forwarder reads the files? because I am concerning about 2 minutes limitation in reading 500 files or 50,000 files.

Thank you for responding to my questions.

 

Henry T

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @henrytran,

I think that an UF can read 50,000 linea in 2.5 minutes, but to be sure, you can do a test.

If your UF is too slow, you can copy the files in another folder, use it for reading and delete files after, but I don't think that's necessary.

Ciao.

Giuseppe

 

View solution in original post

0 Karma

henrytran
Engager

I appreciate it for your responses.

0 Karma