So I've been unable to understand how Splunk works with log ingestion from Folder Monitor when it comes to a document that has already been ingested but has been changed since.
A basic example is a security log. Splunk identifies it, ingests and indexes it etc.
A new entry is added to that security log.
What happens at that point?
Does it reingest the log, duplicating the old data?
Does it not reingest since it has already done so once?
Is it ridiculously smart and just reingests the new data?
Thanks for the help!
... View more
I am currently using transaction to generate a report on length of user session, which is working well. The next iteration is to remove the time the computer is idle [ Windows goes to sleep after 30mins (1800 sec) at which point the event log is "The screen saver was invoked". So if that happens i need to remove 1800seconds from the timer.
Using the transaction i'm defining:
endswith=eval(match(_raw,"BROKER_LOGOFF") OR match(_raw,"The screen saver was invoked"))
I've currently created a field after the transaction "SessionLength", which is defined as duration/60 to show minute length.
I need to have something to the effect of:
IF Transaction closes with "The screen saver was invoked", SessionLength=((duration - 1800)/60)
This is to counter the lack of mouse movement over the last 1800seconds which leads to this event log. I've tried all sorts of IF, CASE... but don't know how reference the last event/message in a transaction. Even if I can say that IF contains "The screen..." then do this, else do that - would be sufficient.
Still relatively new to Splunk, tried exploring for days before posting. Any thoughts?
eval SessionLength(minutes)=if(transaction = "The screen saver was invoked", ((duration - 1800)/60),(duration/60))
so if the transaction is "The screen.." the field equals duration - 1800 then divided by 60. If it doesnt contain the statement its just duration divided by 60.
... View more