Since I usually turned of splunkd service on my local machine and only turn it back on when I need to do some log search. Chances that when I turn the daemon back on, I will have some more files that needs to be indexed right away for search. Is there any way can make Splunk daemon do this? There may be 2 cases: index a file in an already under tracked folder. index a random file that's not under tracking folder. Thanks. ... View more

When parsing some customized log, the format it's like below [timestamps] field name [value] [00:46:38] - Remain Queue [ 0 ] [00:46:38] - Remain Queue [ 2 ] The only search term works for me is "Remain Queue" NOT 0 . I've tried "Remain Queue">0 but no luck. How can I search/sort the remain queue count? How to train splurk to know Remain Queue is a field? Further more, I've got another log entry looks like below. Is it possible to parse it if I want key-value pair become Connect=93? [00:46:38] - Connect [ 330931 / 330838 ] [ 93 ] Thanks. ... View more