Index Log file on demand

[SirHill17]

Hi,

To avoid too much data collection, I would like Splunk to only index a log file following a manual action like clicking on a cell in the search result.

I have already set up the index on the indexer, the class on the deployment-server, but currently it collects every file logs.

i.e.:

2015-06-15 13:40:13 hostname ERROR get_details gf_ServerDetails failed /apps/user/tmp/xxxxxxx.tmp.get_details

So what I would like is when clicking on the file name, Splunk goes to read the file and display the result.

Not sure if my request is clear enough. Do not hesitate to request more details.

Thanks for your help.

Regards,

Cyril

[yannK · Accepted solution]

The indexers/search-head have no control on the forwarders, and also have no knowledge of the list of files available. So you cannot search on log files that have not yet be indexed.

So your question looks more like an Enhancement Request.

Tracks to try manually :

• use the oneshot CLI command to index a file on demand ( on the forwarder)
• to get a list of files on a remote forwarder. try a scripted input doing a simple dir/ ls with file timestamps on a regular basis
• maybe a deployment server could be used to create specific inputs. but will not be great if you have many inputs to handle and clear afterward.

[SirHill17]

The oneshot command could be useful, I will try that.

Thanks.