Monitoring Splunk

index from forwarders every X minutes/hours

jszyba
New Member

Could anybody tell me how to work with the inputs.conf file of a forwarder to set the forwarder to start/stop/index every X amount of time rather than in real time? The cron was mentioned but I'm not so sure how to use it and the documentation is a bit foggy. I basically want the forwarder to start up every X hours and push the latest log file data to the receiver if possible. Thanks all!

Tags (3)
0 Karma

linu1988
Champion

For this you could write a script to stop the splunkforwarder service and start at another point using windows task sceduler(best solution). There is no functionality available in splunk to start or stop the splunk service itself.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...