Getting Data In
Highlighted

Moving away indexed files after indexing

Communicator

Hello,

I index files in a directory. The files are normally created for the sake of being indexed and do not change after indexing (in other words, they are not updated - once created they are frozen).

I noticed that they are sometimes reindexed (not sure why but I can wildly guess they were "touch"-ed (linux speaking) or otherwise modified (their attributes, not content), which triggered a reindexation).

Is there a way to instruct splunk to move then to another predefined directory after they have been indexed?
Alternatively: make it so that splunk would index them only once, no matter the changes (I know that this is possible for a single file but apparently not for a monitored directory)

The first solution (move them away) would be ideal.

Thank you.

0 Karma
Highlighted

Re: Moving away indexed files after indexing

Legend

Splunk has no mechanisms for performing file-system operations like that (other than reading files, of course).

You should check splunkd.log to see what causes Splunk to reindex files. Even if files are touched, Splunk should not reindex them because it keeps a CRC checksum and read offset to see if a file really has changed and if so where it should start reading.

View solution in original post

Highlighted

Re: Moving away indexed files after indexing

Communicator

Thanks. I will have a closer look at splunkd.log as there are interesting messages there anyway (never had a look before)

0 Karma