Dashboards & Visualizations

getting file logs

henrytran
Engager

Hello,

I am working on getting the logs into a dashboard. Files are sitting in the source a 2 minutes and will be moved to another server after 2 minutes time frame. my concern is if there is a script pull the logs within the time frame.

Thanks in advance

 

Henry

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @henrytran,

I think that an UF can read 50,000 linea in 2.5 minutes, but to be sure, you can do a test.

If your UF is too slow, you can copy the files in another folder, use it for reading and delete files after, but I don't think that's necessary.

Ciao.

Giuseppe

 

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @henrytran,

if you have a Universal Forwarder on the server where files are stored, it reads the logs every 30 second (by default but it's configurable), so your files are read before they move.

So you don't need a script.

A script could help if your cannot install a UF on that server, but this isn't a Splunk question, it's a Linux question.

Ciao.

Giuseppe

0 Karma

henrytran
Engager

I am clarifying that how quick the Universal Forwarder reads the files? because I am concerning about 2 minutes limitation in reading 500 files or 50,000 files.

Thank you for responding to my questions.

 

Henry T

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @henrytran,

I think that an UF can read 50,000 linea in 2.5 minutes, but to be sure, you can do a test.

If your UF is too slow, you can copy the files in another folder, use it for reading and delete files after, but I don't think that's necessary.

Ciao.

Giuseppe

 

0 Karma

henrytran
Engager

I appreciate it for your responses.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...