Getting Data In

Are there any resources that explain in detail how Splunk works to monitor files on a universal forwarder?

jldebell
Path Finder

I am trying to find a resource that explains how Splunk works to monitor files. I am familiar with the set up of inputs.conf files and from the Splunk Server side, but I am not familiar with the side that has a Universal Forwarder installed. My understanding is a file/log path is set up so the server produces logs and Splunk will then look for the files. Here are some of the questions I receive:

How long should we maintain the logs in the directory to be monitored?
If the log file is reaching the size limit, will a new file will be created?

Will Splunk capture the old information and the new information without losing data?
How quickly will Splunk capture the information and index it?

Basically, any information related to the universal forwarder server side. Information that describes what the users wanting to have logs collected from Splunk should do and how the process will work from their end.

Thanks for your assistance.

Jenn

1 Solution

kml_uvce
Builder

How long should we maintain the logs in the directory to be monitored?
If the log file is reaching the size limit, will a new file will be created?
its upto you, for example you can maintain for 1 day and new file will be generated after 1 day.
Will Splunk capture the old information and the new information without losing data?
yes
How quickly will Splunk capture the information and index it?
as soon as splunk forwarder process reads data from file and sends to indexer , actually it will not take much time and can be in real time if everything works fine like network latency , buffering etc
http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/inputsconf

View solution in original post

0 Karma

kml_uvce
Builder

How long should we maintain the logs in the directory to be monitored?
If the log file is reaching the size limit, will a new file will be created?
its upto you, for example you can maintain for 1 day and new file will be generated after 1 day.
Will Splunk capture the old information and the new information without losing data?
yes
How quickly will Splunk capture the information and index it?
as soon as splunk forwarder process reads data from file and sends to indexer , actually it will not take much time and can be in real time if everything works fine like network latency , buffering etc
http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/inputsconf

0 Karma

jldebell
Path Finder

Thanks for the information regarding the inputs.conf files. I was coming up with the same resource, but I was looking more specifically for the answers to the questions. Are these documented as part of the process? Thank you for your assistance.

0 Karma

jldebell
Path Finder

Here is the information I was looking for.

http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Monitorfilesanddirectories

Thanks again for your assistance!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...