Is there a way to add an interval setting to define the polling for a flat file? Not sure why it was requested but i was asked if it was possible and thought for sure it was only to find that it is currently not an option according to the inputs.conf section in the admin manual. https://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf I read that the default polling may be 1ms, to collect the modified file in near real time. I offered an alternative to create a sh or ps to Get-Content or some other scripting language and then set an interval to read the flat file at their desired time, however i would have to duplicate all of the options available for a file monitor stanza such as crcsalt and whitelist blacklist within the script which would have to be code reviewed and go through a lengthy pipeline. ANy help would be appreciated to say if this is a definite no go or if it is a possible ehancement request to splunk for the next version. thank you     ... View more

I was tasked with tracking the usage and cleanup of lookups for my envrionment and was wondering does splunk create an audit item or item within internal logs to track when a search produces a knowledge item such as a lookup to log the user who created the item plus the original search? Currently these lookups are owned by nobody and if the search was not saved then the search becomes lost if i cannot search through history to find any search that references the outputlookup command. ... View more

I am asking because I attempted to use "savedsearch=" as a command after a | tstats much like calling a "datamodel=" , and I now see that the "savedsearch=" is highlighhted as if it should be as if it is an accepted command. |tstats savedsearch=mysavedsearch ... View more

I am attempting to come up with a solution to hold log data for 180 days for data within an index that has a retention time of 90 days? Initially I thought of the summary index, but was advised that we should try report acceleration first if holding data for less than a year. I am also open to using a datamodel summary so that i can use tstats to return data much faster. Will the report acceleration option save the data independently of the original raw data that will us to keep the same 90 day retention period and access or should we go ahead and add to the summary index? ... View more