Sorry for the really newb question (because I am one).
I have Splunk Enterprise running on my standalone PC to evaluate it. I have managed to get Splunk to monitor my PC's volumes, directories & files OK...but the **bleep** thing insists on trying to index the contents of every file too. Obviously, this is very resource-intensive and I really don't want the file contents indexed.
How do I stop it indexing the file contents? Or, even better, tell it not to index any file contents except for specific file extensions?
I think I have the solution: I already had the "File Meta-data" app but was using the "Files & Directories" "Data Input" (which does index the contents of the file/all files in the directory) rather than the "File Meta-data" "Data Input" (which "Import[s] file and directory meta-data (size, modification dates, etc.)". This also adds a new "File Meta-data" entry in the "Add Data" "Monitor" sources too.
I have it timed to run every 24 hours so will have to wait 24 hours for it to have triggered at some time in the interim. The documentation on that "File Meta-data" app is rather spartan to say the least but I think I am on the right path. Just need a bit of trial and error now, I think.
I have upvoted both of you though 😊.
@gcusello- In my old programming days, yes, I would have created such a script but I expected that such integrated tools like Splunk should be able to integrate directly with the FS by now to at least do that for me 😊.
@richgalloway- If I can't get my expected solution to work (it bloody well should work), I will have a look at yours next. There's always different ways of skinning the same cat...though, yes, this is quite a primitive cat to have Splunk get its teeth into.