index from forwarders every X minutes/hours

[jszyba]

Could anybody tell me how to work with the inputs.conf file of a forwarder to set the forwarder to start/stop/index every X amount of time rather than in real time? The cron was mentioned but I'm not so sure how to use it and the documentation is a bit foggy. I basically want the forwarder to start up every X hours and push the latest log file data to the receiver if possible. Thanks all!

[linu1988]

For this you could write a script to stop the splunkforwarder service and start at another point using windows task sceduler(best solution). There is no functionality available in splunk to start or stop the splunk service itself.