Getting Data In

Is there a way to get Splunk to do oneshot indexing sequentially?

rf2010
New Member

I have a large number of files (going by the thousands) that I only need to index once, and since I want to know when the indexing has completed, I make use of the oneshot adding command in the CLI to do this.

The problem is, Splunk indexes all the files in its oneshot list at the same time (correct me if I'm wrong on this), which makes the indexing exponentially slower as more files are added to the oneshot list.

Adding in a fixed delay in the CLI script is one way to help, but it's not the best solution here.

Is there any way to alter the behaviour of the oneshot indexing to index only one log file after another instead of all at once?

Tags (2)
0 Karma

ddeighton
Explorer

I just kicked off a BASH for loop to index several files and they are indexing sequentially. You may want to try that.

For example:

for file in file1 file2 file3; do
 splunk add oneshot $file
done
0 Karma

ddeighton
Explorer

OK. I take it back. On a system that is set up as a forwarder, the files are being sent sequentially to the indexer. Not sure if this is by design, but that is what I'm seeing.

On the indexer, all of the files are being indexed at once.

0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...