Getting Data In
Highlighted

Monitor daily reports

Engager

I need to monitor daily reports with splunk.
However the events in the logs are constantly updated throughout the day as each event lasts a whole a day.
is there anyway to configure splunk to ensure that it does not parse the event into splunk untill the event has finished?

0 Karma
Highlighted

Re: Monitor daily reports

SplunkTrust
SplunkTrust

Hi iceokoli,

no, this is not possible using a monitor stanza in inputs.conf. A Monitor stanza will observe the file or directory constantly for new data.

But ...

  • you could setup a monitor stanza in inputs.conf to monitor a directory and have some cron driven script that will copy the source file in question into that directory. Splunk will then take only this copied file and index its data.
  • if you're using an universal forwarder to monitor this file, use a cron job to start and stop Splunk universal forwarder at a curtain time during the day.
  • you can create some script wrapper that starts the universal forwarder after that event in question is finished ...

You see, there are some options but out of the box this will not work the way you asked.

hope this helps ...

cheers, MuS

Highlighted

Re: Monitor daily reports

Engager

thanks alot

0 Karma
Highlighted

Re: Monitor daily reports

SplunkTrust
SplunkTrust

you're welcome. please mark this as answered by ticking the tick - thx 🙂

0 Karma