Monitor daily reports

[iceokoli]

I need to monitor daily reports with splunk.
However the events in the logs are constantly updated throughout the day as each event lasts a whole a day.
is there anyway to configure splunk to ensure that it does not parse the event into splunk untill the event has finished?

[MuS]

Hi iceokoli,

no, this is not possible using a monitor stanza in inputs.conf. A Monitor stanza will observe the file or directory constantly for new data.

But ...

• you could setup a monitor stanza in inputs.conf to monitor a directory and have some cron driven script that will copy the source file in question into that directory. Splunk will then take only this copied file and index its data.
• if you're using an universal forwarder to monitor this file, use a cron job to start and stop Splunk universal forwarder at a curtain time during the day.
• you can create some script wrapper that starts the universal forwarder after that event in question is finished ...

You see, there are some options but out of the box this will not work the way you asked.

hope this helps ...

cheers, MuS

[MuS]

you're welcome. please mark this as answered by ticking the tick - thx 🙂

[iceokoli]

thanks alot