I tried ingesting it using add oneshot then midway through it, splunk suddenly stops.
Aside from splitting the file, is there a way to ingest this file without splunk stopping suddenly?
Can splunk monitor three 200gb+ files at the same time?
What is the reason for using a heavy forwarder?
Splunk is not good at fetching large files at once with default settings.
The problem is that while importing a file, one pipeline monopolizes processing.
It is necessary not to concentrate on one indexer as well as the pipeline that detects and captures logs.
It is important to investigate which process is the problem.
Hi, thank you for input.
A cluster with three indexer.
I'm using a heavy forwarder to process the CSVs to be sent to the cluster. So is it not possible to ingest that large file?