I have a script containing ip and value.
Sh basic.sh>>sample.out
Know to get the logs i need to add this sample.out file to splunk like
/opt/splunkforwarder/bin/splunk add monitor sample.out.
Then i the files will comes into splunk..
But the problem is i want that script to be run everyone one hour..everytime adding that output file to splunk is not a good idea..Is there any way to schedule automatically or monitor that output file all the time...
i want to avoid the below step everytime
"/opt/splunkforwarder/bin/splunk add monitor filename"
can i add it to this folder
monitor://$SPLUNK_HOME/var/log/splunk]
Thank you!
If the script always writes to the same file you only need to add the monitor once. Splunk will then periodically check the file for changes and automatically index them.
If the script always writes to the same file you only need to add the monitor once. Splunk will then periodically check the file for changes and automatically index them.