Import OLD event logs from backup drive

[berniefieldhous]

Hi...

I'm trying to import 'thousands' of old event logs into Splunk to setup a searchable database....

I can enter them in one at a time using the "Data Input > Files & Directories > upload a file" but this would take forever....

Is there any other way to feed in all this data into splunk ????

Cheers Bernie

[gkanapathy]

Depending what you're doing, it may not be a bad idea to script it with the splunk add oneshot commmand. The command is inexplicably barely documented in the official docs, but several examples exist on answers.splunk.com.

[Genti]

in other words, do not use one time uploading but use monitoring stanzas. More info here: http://www.splunk.com/base/Documentation/4.1.5/admin/MonitorFilesAndDirectories

[Genti]

Where are these thousands of events located. It seems like they are in a drive, can you not include the main directory where these logs are instead of doing it one by one? i.e. instead of doing
[monitor:///backup/logs/a.log] do [monitor:///backup/logs/] or better yet, [monitor:///backup/]