Getting Data In

How to invoke Splunk daemon to parse newly added file right away

Stan
New Member

Since I usually turned of splunkd service on my local machine and only turn it back on when I need to do some log search.

Chances that when I turn the daemon back on, I will have some more files that needs to be indexed right away for search. Is there any way can make Splunk daemon do this? There may be 2 cases:

  1. index a file in an already under tracked folder.
  2. index a random file that's not under tracking folder.

Thanks.

Tags (1)
0 Karma
1 Solution

Genti
Splunk Employee
Splunk Employee

The file that is already under a tracked folder should be picked up automatically by splunk as soon as it gets turned on.
To monitor the new file all you have to do is login to splunk, go to manager, then data inputs and then files and directories. There you can tell splunk to monitor the new file and the parsing should start immediately. Follow these breadcrumbs: Manager » Data inputs » Files & Directories » Add New

View solution in original post

0 Karma

Genti
Splunk Employee
Splunk Employee

The file that is already under a tracked folder should be picked up automatically by splunk as soon as it gets turned on.
To monitor the new file all you have to do is login to splunk, go to manager, then data inputs and then files and directories. There you can tell splunk to monitor the new file and the parsing should start immediately. Follow these breadcrumbs: Manager » Data inputs » Files & Directories » Add New

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...