Can I monitor files on a schedule instead of a continuously monitoring a file?

[leo_wang]

Due to the question I posted before :
http://answers.splunk.com/answers/291010/how-to-merge-a-multiline-event-correctly.html

I have an idea that if the Splunk could monitor the files on a schedule (not always continuously monitoring the log), I could avoid the multiline event problem.
Because our batch jobs will finish after AM 3:00, the logs will not grow after this time and the multiline event will group correctly.

[potnuru]

Hi @leo_wang , Did you solve the multi-line event problem for Batch Scripts? If Yes, Please share the solution it with me.

[woodcock]

The way to do this is to setup 2 cron jobs on your forwarder as the same user as Splunk was installed (is running) that do this:

30 4 * * * /usr/bin/mv $SPLUNK_HOME/etc/apps/myapp/inputs.conf $SPLUNK_HOME/etc/apps/myapp/inputs.off && $SPLUNK_HOME/bin/splunk restart
30 3 * * * /usr/bin/mv $SPLUNK_HOME/etc/apps/myapp/inputs.off $SPLUNK_HOME/etc/apps/myapp/inputs.conf && $SPLUNK_HOME/bin/splunk restart

Or, if you dislike being so drastic, you can create a soft link to the directory where the files are, update your inputs.conf to point to the soft link and then do a similar thing but create and remove the soft link. Then you will not have to restart Splunk each time.

[richgalloway]

Perhaps you could modify the batch job to move your log files into a monitored directory when the job completes. Alternatively, you could create a second batch job to move the logs every morning.