Solved: Can Splunk Ingest This? - Splunk Community

Getting Data In

Hi, can Splunk ingest .edb (Exchange Database) files?

1 Solution

Solution

You can create a monitor input on this file on forwarder and check if data is indexed or not.

[monitor:///tmp/*.edb]
sourcetype = test_data

Search query: index=main sourcetype = test_data

View solution in original post

Solution

You can create a monitor input on this file on forwarder and check if data is indexed or not.

[monitor:///tmp/*.edb]
sourcetype = test_data

Search query: index=main sourcetype = test_data

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...