Determining which all files are already indexed in a directory which is being monitored by a monitor mode

[dishasaxena]

Assuming we are indexing files in a directory which is in a monitor mode, then how to determine how many files are being already indexed and how many are left to be indexed at that particular time. We need to use this in order to remove or move files from that directory which are already indexed for storage consumption purpose.

[dishasaxena]

Hi,

These blogs really helped.I used the approach given in first blog. Thanks!!

Regards,
Disha

[jbsplunk · Accepted solution]

From $SPLUNK_HOME/bin you can run 'splunk _internal call /services/admin/inputstatus/TailingProcessor:FileStatus'. If a file has been read, Splunk will tell you. By the way, there is already a view in the SoS app which provides visualizations around this command's output.

[dishasaxena]

Thanks for the answer.

Regards,
Disha

[somesoni2]

These posts can be useful.
Custom script-
http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/

From Splunk internal logs
http://blogs.splunk.com/2012/09/10/tracking-indexing-status-in-splunkd-log-and-metrics-log/