Getting Data In

Splunk as a simple indexer

bulliarda
Explorer

We have a requirement to index a DFS folder containing a lot of subfolders and files from different servers. The goal is to be able to do simple keywords based search against these logs. The logs are different in format, so we will not try to add knowledge by extracting fields. The questions we have are: 1) can we configure Splunk to give the indexing time as the timestamp to an event? We do not want to let him calculate the event timestamp. 2) can we schedule when Splunk has to do the indexing? We would like to run it once per hour, we don't need real time. 3) do you have any tips to apply when you index a lot of files and folders, with many subfolders?

I know it is not really what Splunk is for, but the goal is to have the same tool to do different research and Splunk is now THE tool for log analysis. If he is not able to do this "simple" thing, people would not understand.

Many thanks for your inputs.

0 Karma
1 Solution

ziegfried
Influencer

1) Can be configured in props.conf

[your_sourcetype]
DATETIME_CONFIG=CURRENT

You have to reference the sourcetype in your inputs.conf as well:

[montior:///path/to/monitored/directory]
sourcetype = your_sourcetype

2) No, there is no way to configure a schedule for file monitoring in Splunk.

View solution in original post

ziegfried
Influencer

1) Can be configured in props.conf

[your_sourcetype]
DATETIME_CONFIG=CURRENT

You have to reference the sourcetype in your inputs.conf as well:

[montior:///path/to/monitored/directory]
sourcetype = your_sourcetype

2) No, there is no way to configure a schedule for file monitoring in Splunk.

bulliarda
Explorer

Perfect! Thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...