Getting Data In

How to CONTINOUSLY monitor logs on HTTP url

Criviere
New Member

Hello,

I'm trying to monitor some logs that I have on an http url, the url structure is

http://subdomain.domain.com:port/path_to_log/

This url is only accessible inside of the network I'm in.

0 Karma

Sukisen1981
Champion

Hi,

One option could be to ingest this url by using the rest api modular app - https://splunkbase.splunk.com/app/1546/
then set the monitoring by using the cron expression, I believe the cron will allow you to set as low a polling interval as 30 secs. or maybe even lower

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi Criviere,

If this log has a timestamp in it, you could write a modular input that polls every x minutes for data. Then you use the last timestamp out of the logs in a checkpoint file. On the next run you query the checkpoint time and only get events that are newer. I have done this before and works like a charm.

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...