Getting Data In

When indexing historic and real time data together, does Splunk index old data first and new data last or vice versa?

ankithreddy777
Contributor

I have to index the historic data along with real time data from the log file. May I know from which point the indexing starts; whether it starts ingesting old data first and latest data at the end, or vice versa? .

0 Karma
1 Solution

bshuler_splunk
Splunk Employee
Splunk Employee

When indexing a file, it indexes line by line, starting with the beginning, and ending with the end of file.

View solution in original post

bshuler_splunk
Splunk Employee
Splunk Employee

When indexing a file, it indexes line by line, starting with the beginning, and ending with the end of file.

ankithreddy777
Contributor

thank you, Suppose the UF is restarted ,May I know how Splunk remember the line where it got stopped previously to start ingestion from that point. If not will it start ingestion again from the beggining of the file?

0 Karma

bshuler_splunk
Splunk Employee
Splunk Employee

There is a "magic" index called fishbucket. All of the pointers for remembering the last location for files are in it. Splunk does not forget and reindex.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...