Getting Data In

Monitor files with inputs.conf

herokhoo90
Engager

I would like to check will there be any impact if i use inputs.conf to monitor those files (i.e. 1000+) that do not exist yet? This is to prepare for data on-boarding.  

Will Splunk keep searching for the files and write error message into splunk log, which result in performance issue or other issue?

Thanks.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
You can put non-existent files in your monitor stanzas. Splunk will silently wait for them to be created.
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust
You can put non-existent files in your monitor stanzas. Splunk will silently wait for them to be created.
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!