Getting Data In

Setting up input for file monitoring

misteryuku
Communicator

If the wireshark text file is simply stored as a rolling text file (i.e. more data is appended to file, and not stored in a new file). I would set the input up as a "file monitor". I would like to know how do set the input file as a "file monitor"?

0 Karma

Drainy
Champion

http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureyourinputs

I think you may need to sit down and read through alot of the documentation to become completely familiar with the product. Have you seen the videos on the Splunk site? they sometimes hold free webinars of basic training.

In the meantime, I would suggest that running TCPDUMP as a scripted input would be a better solution.

misteryuku
Communicator

okay i see. I go check them out.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...