Data ingest

[splunkville]

Monitor set to pull in a watched log that has no props/transforms configs applied. This would ingest the entire file contents, correct? 

[livehybrid]

Hi @splunkville 

The default configurations for a sourcetype can often be "good enough" for some logs, Splunk does a good job at determining timestamp extraction but if your logs contain multi-line events, long lines (>10000 chars),multiple timestamps or anything like this then it might struggle or you might get mixed results.

Its also worth noting that from a performance perspective its best to tweak these settings and incorporate the "Great 8" (See https://lantern.splunk.com/Splunk_Platform/Product_Tips/Data_Management/Configuring_new_source_types) to ensure accuracy but also to improve performance of the data being ingested.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[gcusello]

Hi @splunkville ,

yes, in general, if you configure a monitor you read the file, but what's your issue and you question?

Are you working on a Universal Forwarder or a stand alone Splunk server or what else?

Please, share more datails about your issue.

Ciao.

Giuseppe

[splunkville]

Since no configs are telling splunk how to parse the data, it will pull in / read the entire contents of the file by default. That is my understanding.

This monitor is set in a config file pushed to the uf. All I'm doing is telling splunk to go get that log. Not concerned with formatting / parsing right now. Is there anything that will stop / limit this incoming data?

[gcusello]

Hi @splunkville ,

yes it is correct, but what's your issue?

Ciao.

Giuseppe