Getting Data In

Upload File vs. Index-once Monitor File

morethanyell
Builder

upload vs monitor file (index once)

Would like to get some enlightenment on what's the difference between the two. TIA

0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

Upload would be for data that is on your local machine, while the monitor / index once option would be if the data is local to Splunk.

View solution in original post

kmorris_splunk
Splunk Employee
Splunk Employee

Upload would be for data that is on your local machine, while the monitor / index once option would be if the data is local to Splunk.

morethanyell
Builder

I understand tho that once I upload, say for example a CSV file, using Add Data > Upload OR Add Data > Monitor > Files & Directories > Index Once they're both written on the disk where Splunk deployed (as long as I use the same index). Is that right?

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...