Getting Data In

Spotting when a file has been finished indexing?

szabados
Communicator

I have a monitor input, which rarely has new files, and I'd like set up an alert for it. How can I find something about when a file has been finished reading in ?

Tags (3)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi szabados,

take a look at this great blog post http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/ where you learn to use the REST endpoint of the TailingProcessor to show its activities and what files are currently being read.

Hope this helps ...

cheers, MuS

0 Karma

szabados
Communicator

Thanks, but my idea was to set up an alert in splunk, based on the contents of the internal log of the forwarder.

0 Karma

MuS
SplunkTrust
SplunkTrust

You could enable debugging on the TailingProcessor on the forwarder http://docs.splunk.com/Documentation/Splunk/6.3.0/Troubleshooting/Enabledebuglogging and look what is reported in index=_internal or read the docs here http://docs.splunk.com/Documentation/Splunk/latest/Data/Troubleshoottheinputprocess

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...