Getting Data In

Setting up input for file monitoring


If the wireshark text file is simply stored as a rolling text file (i.e. more data is appended to file, and not stored in a new file). I would set the input up as a "file monitor". I would like to know how do set the input file as a "file monitor"?

0 Karma


I think you may need to sit down and read through alot of the documentation to become completely familiar with the product. Have you seen the videos on the Splunk site? they sometimes hold free webinars of basic training.

In the meantime, I would suggest that running TCPDUMP as a scripted input would be a better solution.


okay i see. I go check them out.

Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...