Getting Data In

Monitor daily reports

iceokoli
Engager

I need to monitor daily reports with splunk.
However the events in the logs are constantly updated throughout the day as each event lasts a whole a day.
is there anyway to configure splunk to ensure that it does not parse the event into splunk untill the event has finished?

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi iceokoli,

no, this is not possible using a monitor stanza in inputs.conf. A Monitor stanza will observe the file or directory constantly for new data.

But ...

  • you could setup a monitor stanza in inputs.conf to monitor a directory and have some cron driven script that will copy the source file in question into that directory. Splunk will then take only this copied file and index its data.
  • if you're using an universal forwarder to monitor this file, use a cron job to start and stop Splunk universal forwarder at a curtain time during the day.
  • you can create some script wrapper that starts the universal forwarder after that event in question is finished ...

You see, there are some options but out of the box this will not work the way you asked.

hope this helps ...

cheers, MuS

MuS
SplunkTrust
SplunkTrust

you're welcome. please mark this as answered by ticking the tick - thx 🙂

0 Karma

iceokoli
Engager

thanks alot

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...