Experts, This could be expected behavior but the SDK documentation doesn't mention that the index.upload is supposed to work for only paths local to the server running splunk instance. I tried to use index.upload against splunk instance running on the same server and there is no exception. But when i try the same code for remote server there is a file not found exception. If this an accepted behavior then my question is what is the equivalent way to upload a file to remote server (because the Splunk Web works perfect for remote file uploads too) Thanks! [Fatal Error] :1:1: Premature end of file. com.splunk.HttpException: HTTP 400 -- <?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="ERROR">In handler 'oneshotinput': unable to open file: path='C:\Users\tanmay\Downloads\20131208_test.tar.gz' error='No such file or directory'</msg> </messages> </response> at com.splunk.HttpException.create(HttpException.java:84) at com.splunk.HttpService.send(HttpService.java:386) at com.splunk.Service.send(Service.java:1261) at com.splunk.HttpService.post(HttpService.java:243) at com.splunk.EntityCollection.create(EntityCollection.java:95) at com.splunk.Index.upload(Index.java:1111) ..... ... View more

Is there a way to pass host attribute value for oneshot upload in java sdk for splunk? The example on splunk documentation shows that valid parameters for oneshot upload include both host_regex and host. Any way I can set it for index.upload? The only parameter that it currently accepts is the path of the file to be uploaded Thanks! ... View more

I am clear of steps needed for uploading a .tar file but I have a question about how does it work. Splunk indexes the file eventually and stores it in the database which isn't easily human readable. Path to indexes can be configured in splunk settings. Knowing this, my queries are: When you upload of file of say 10 MB on the remote splunk server, where is it stored? i tried $SPLUNK_HOME/var/spool/splunk immediately after uploading the file. There was no file in it. Do we have a way to configure where the uploaded file is stored? Does the file get eventually deleted on the remote server? If logs from a different date are uploaded later which have still got the already indexed data is that repetition handled? Thanks! ... View more