Getting Data In

Can I configure Splunk to index the search.log files for each search?

andrewtrobec
Motivator

Hello,

I'm trying to get more detailed information about my scheduled saved searches, especially when they complete with success but contain errors and warnings in the stack trace.

I see that all details are stored in the $SPLUNK_HOME/var/run/splunk/dispatch folder and I am wondering if this folder can be monitored by Splunk.

Is this possible?

Thank you and best regards,

Andrew

Labels (2)
Tags (2)
0 Karma

s2_splunk
Splunk Employee
Splunk Employee

I don't see why not, any directory or file can be monitored. You'd probably want to index this into a dedicated and short-lived index since this can possibly be a significant amount of data.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...