Can Splunk index the complete folder? If yes, how can we achieve this?

[kratikaj07]

Can Splunk index the complete folder? If yes, how can we achieve this?

[strive · Accepted solution]

from splunk documentation of inputs.conf file

[monitor://<path>]  
* This directs Splunk to watch all files in <path>.   
* <path> can be an entire directory or just a single file.  
* You must specify the input type and then the path, so put three slashes in your path if you are starting   
at the root (to include the slash that goes before the root directory).

http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/inputsconf

[kratikaj07]

Thanks.It works with "Skip Preview" option.

[strive]

Can you Skip Preview and try. Choose Skip Preview option and index files.
I have indexed archive files and it works.

Splunk Enterprise decompresses archive files before it indexes them. It can handle these common archive file types: tar, gz, bz2, tar.gz, tgz, tbz, tbz2, zip, and z.
If you add new data to an existing archive file, Splunk Enterprise will re-index the entire file, not just the new data in the file. This can result in duplication of events.

See this link: http://docs.splunk.com/Documentation/Splunk/6.1.2/Data/MonitorFilesAndDirectories

[kratikaj07]

I am getting error when I am uploading zip file like this:

Unable to process the file : Cannot preview archive file.

[strive]

Using splunk web you can upload zip file containing your log files.
Splunk Enterprise recognizes the following archive filetypes: tar, gz, bz2, tar.gz, tgz, tbz, tbz2, zip, and z

[kratikaj07]

Ok..Thanks for the quick response..I have one more question is it possible using Splunk Web?

[strive]

You can use [batch://] for large archives of historic data. See, BATCH ("Upload a file" in Splunk Web): section.

[kratikaj07]

Yes..I mean to say all log file present in a folder so instead of going and uploading each file.Is there any way to index complete folder in one shot?

[strive]

do you mean all the log files present in a folder?