How to CONTINOUSLY monitor logs on HTTP url

[Criviere]

Hello,

I'm trying to monitor some logs that I have on an http url, the url structure is

http://subdomain.domain.com:port/path_to_log/

This url is only accessible inside of the network I'm in.

[Sukisen1981]

Hi,

One option could be to ingest this url by using the rest api modular app - https://splunkbase.splunk.com/app/1546/
then set the monitoring by using the cron expression, I believe the cron will allow you to set as low a polling interval as 30 secs. or maybe even lower

[MuS]

Hi Criviere,

If this log has a timestamp in it, you could write a modular input that polls every x minutes for data. Then you use the last timestamp out of the logs in a checkpoint file. On the next run you query the checkpoint time and only get events that are newer. I have done this before and works like a charm.

cheers, MuS