Assuming we are indexing files in a directory which is in a monitor mode, then how to determine how many files are being already indexed and how many are left to be indexed at that particular time. We need to use this in order to remove or move files from that directory which are already indexed for storage consumption purpose.
From $SPLUNK_HOME/bin you can run 'splunk _internal call /services/admin/inputstatus/TailingProcessor:FileStatus'. If a file has been read, Splunk will tell you. By the way, there is already a view in the SoS app which provides visualizations around this command's output.
Hi,
These blogs really helped.I used the approach given in first blog. Thanks!!
Regards,
Disha
From $SPLUNK_HOME/bin you can run 'splunk _internal call /services/admin/inputstatus/TailingProcessor:FileStatus'. If a file has been read, Splunk will tell you. By the way, there is already a view in the SoS app which provides visualizations around this command's output.
Thanks for the answer.
Regards,
Disha
These posts can be useful.
Custom script-
http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/
From Splunk internal logs
http://blogs.splunk.com/2012/09/10/tracking-indexing-status-in-splunkd-log-and-metrics-log/