Getting Data In

Upload File vs. Index-once Monitor File

morethanyell
Builder

upload vs monitor file (index once)

Would like to get some enlightenment on what's the difference between the two. TIA

0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

Upload would be for data that is on your local machine, while the monitor / index once option would be if the data is local to Splunk.

View solution in original post

kmorris_splunk
Splunk Employee
Splunk Employee

Upload would be for data that is on your local machine, while the monitor / index once option would be if the data is local to Splunk.

morethanyell
Builder

I understand tho that once I upload, say for example a CSV file, using Add Data > Upload OR Add Data > Monitor > Files & Directories > Index Once they're both written on the disk where Splunk deployed (as long as I use the same index). Is that right?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...