Is there any way we can control logs generation time?

[VijayA]

Hi, Can you advise on my Query.

Splunk Universal Forwarder installed on client machine, the are generating log files for every 2hrs, is there any way we can control there logs generation time? can we set anything in UF to generate log files for every 30mins and push to Indexer?

[VijayA]

Hi,

NO problem from Splunk side, I'm comparing 2 logs from different servers, both are coming to Splunk in different times, not able to extract the correct results. Hence, checking if there any possibility to control.

Thanks for your inputs! 

[VijayA]

Hi,

You mean, we can't control the frequency of sending logs from UF to Index, like for every 30mins? 

I have no issues with bandwidth occupation,  only I want to know is can we set any time frequency to send logs. 

[gcusello · Accepted solution]

Hi @VijayA,

as I said, Splunk continously checks the presence of new logs and reads and sent them.

What's the problem for this behavior?

Ciao.

Giuseppe

[gcusello]

Hi @VijayA,

Splunk reads and immediately sends files when they are generated, the generation frequency hasn't inpact one the UF activity.

If you want to limit the bandwidth occupation of your data, you can setup a limit of the dimension of the data packets sent by the UF, but you don't need any intervene on the frequency.

ciao.

Giuseppe