how to extract data on hourly basis in Windows platform

[pramodkumar]

Hi Team,

My Scenario is to fetch data from my local directory(Windows OS) into Splunk on hourly basis, if the file is placed then Splunk had to identify the file and extract the data. And want to automate the process, please help me.

Thanks,
Pramod

[kristian_kolb · Accepted solution]

create/edit a file called inputs.conf in c:\program files\splunk\etc\system\local

[monitor://c:\path\dir]
index=blah
sourcetype=blah

Any file that gets put into the directory will be automatically indexed, and continually monitored for new additions. If your files are updated, splunk will see that almost immediately and index the new events.

For more information, see the Getting Data In section of the manual.

Hope this helps,

Kristian