Getting Data In
Highlighted

Import OLD event logs from backup drive

Hi...

I'm trying to import 'thousands' of old event logs into Splunk to setup a searchable database....

I can enter them in one at a time using the "Data Input > Files & Directories > upload a file" but this would take forever....

Is there any other way to feed in all this data into splunk ????

Cheers Bernie

Tags (1)
Highlighted

Re: Import OLD event logs from backup drive

Splunk Employee
Splunk Employee

Where are these thousands of events located. It seems like they are in a drive, can you not include the main directory where these logs are instead of doing it one by one? i.e. instead of doing
[monitor:///backup/logs/a.log] do [monitor:///backup/logs/] or better yet, [monitor:///backup/]

Highlighted

Re: Import OLD event logs from backup drive

Splunk Employee
Splunk Employee

in other words, do not use one time uploading but use monitoring stanzas. More info here: http://www.splunk.com/base/Documentation/4.1.5/admin/MonitorFilesAndDirectories

0 Karma
Highlighted

Re: Import OLD event logs from backup drive

Splunk Employee
Splunk Employee

Depending what you're doing, it may not be a bad idea to script it with the splunk add oneshot commmand. The command is inexplicably barely documented in the official docs, but several examples exist on answers.splunk.com.