Monitor files with inputs.conf

[herokhoo90]

I would like to check will there be any impact if i use inputs.conf to monitor those files (i.e. 1000+) that do not exist yet? This is to prepare for data on-boarding.  

Will Splunk keep searching for the files and write error message into splunk log, which result in performance issue or other issue?

Thanks.

[richgalloway · Accepted solution]

You can put non-existent files in your monitor stanzas. Splunk will silently wait for them to be created.