Every ingested event in Splunk must have a time association. It doesn't really matter if that's just the ingested time, but a lot will depend on what you want to do with that data once it's there. A...
See more...
Every ingested event in Splunk must have a time association. It doesn't really matter if that's just the ingested time, but a lot will depend on what you want to do with that data once it's there. Also, bear in mind that Splunk is generally about multiple single or multi-line events. If you're going to ingest documents that are large then Splunk is not really designed for that as there are certain soft limits that apply, such as event length limit of 10,000 chars I believe. However, there are still ways you can do what you want, e.g. break a document into lines of text and ingest those into Splunk e.g. with time, text, line#, document_name per event, so you could reconstitute the document by ordering the document rows by line number. What's your use case?