Monitoring Splunk

monitor latest file only

katalinali
Path Finder

I write a script to blacklist the oldest file but splunk don't reload inputs.conf until someone restart the services but it is not acceptable in my case. Do there are any options that control splunk to monitor only latest file or some rule like abandon oldest file when I need to monitor a folder that contains over thousands of file.

Tags (1)
0 Karma

ziegfried
Influencer

The easiest way would be to monitor a separate folder and let the script place a symlink for the latest file there.

katalinali
Path Finder

It is windows platform and I don't have the right to control where the file should be placed. It may not work for me

0 Karma

dwaddle
SplunkTrust
SplunkTrust

The main caveat being sure you know when the latest file is 'done' and splunk has completely indexed it before redoing the symlink. Perhaps a good compromise might be to keep a symlink to the most current log and the one most-previous log. That way, Splunk can still have access to the prior 'latest' file right around the time of switchover.

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...