Splunk for none time based data

[orendado]

I'm considering loading readable/textual  files , from different formats, into splunk for getting the benefits of indexing and fast searching. Thh files are static and don't change like regular logs. Is this use case supported by splunk??

[bowesmana]

Every ingested event in Splunk must have a time association. It doesn't really matter if that's just the ingested time, but a lot will depend on what you want to do with that data once it's there.

Also, bear in mind that Splunk is generally about multiple single or multi-line events. If you're going to ingest documents that are large then Splunk is not really designed for that as there are certain soft limits that apply, such as event length limit of 10,000 chars I believe.

However, there are still ways you can do what you want, e.g. break a document into lines of text and ingest those into Splunk e.g. with time, text, line#, document_name per event, so you could reconstitute the document by ordering the document rows by line number.

What's your use case?

[orendado]

Hi, I'll try to more specific, I have text files (one data type for example) those *.txt files contain geographic data that i would like to query using Splunk.

The size and for format  of those files are varies, it could be txt, xml, json.... 1kb-10mb

[bowesmana]

As I said, you can ingest such data, but if you have a 10Mb file with a single line of text, which would constitute a single event, you would have to make sure that the max line length limits are tweaked. Having said that, I am not sure how Splunk or the browser would handle a 10Mb single event.

Still, the answer really is that you _can_ ingest the data, but whether it will ultimately be a good fit for your purpose cannot easily be known, for example, does geographic data mean descriptions of landscape features or geological attributes and you are looking to discover what type of rock may have gold in it, or are you looking to get topographical information from coordinates and elevation data?

Really, Splunk's good at taking multiple pieces of data and performing aggregations and correlations with that data.