Getting Data In

Wait time before indexing data

shayhibah
Path Finder

Hi,

I would like to know if there is an option to wait for/ minute X seconds before indexing the data.
The goal is to index only the last log in the time range (there is no way to recognize the last log).

Is it possible?

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You didn't give us much to work with, but perhaps the inputs.conf settings time_before_close or multiline_event_extra_waittime will help.

---
If this reply helps you, Karma would be appreciated.
0 Karma

shayhibah
Path Finder

Hi richgalloway,

In my system, I export logs to splunk server.
each log may be updated by another log - it means that in case I export log with some data and now I have an update on this data, a log with the new information is sent.

I would like to ignore all logs with the same uid but only keep the last one.
Is it possible to do it?

Thank you!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you replacing the entire log when an update is made or adding to the end of a log?
The normal process for Splunk is to read log files as they are written. That makes data available to searches about a minute after it is written to the log.

---
If this reply helps you, Karma would be appreciated.
0 Karma

shayhibah
Path Finder

I would like to replace the entire log.

Is it possible?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I find Splunk works best when new events are added to the end of a log file. One can replace the entire file and Splunk will usually (but not always) recognize the change and re-index the entire file. However, that results in duplicate events which must be accommodated in your searches.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...