Adding an Interval to a Monitor Stanza

[ericg57]

Is there a way to add an interval setting to define the polling for a flat file? Not sure why it was requested but i was asked if it was possible and thought for sure it was only to find that it is currently not an option according to the inputs.conf section in the admin manual.

https://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf

I read that the default polling may be 1ms, to collect the modified file in near real time. I offered an alternative to create a sh or ps to Get-Content or some other scripting language and then set an interval to read the flat file at their desired time, however i would have to duplicate all of the options available for a file monitor stanza such as crcsalt and whitelist blacklist within the script which would have to be code reviewed and go through a lengthy pipeline.

ANy help would be appreciated to say if this is a definite no go or if it is a possible ehancement request to splunk for the next version.

thank you

[gcusello]

Hi @ericg57,

I agree with you: I don't remember that it's possible to change the monitoring interval but why do you want this?

It's better to have the new events as soon as possible, and they are read in near real time.

The solution with a script is possible but it makes the same job of the monitor command, so why?

Ciao.

Giuseppe