Hello,
I'm trying to monitor some logs that I have on an http url, the url structure is
http://subdomain.domain.com:port/path_to_log/
This url is only accessible inside of the network I'm in.
Hi,
One option could be to ingest this url by using the rest api modular app - https://splunkbase.splunk.com/app/1546/
then set the monitoring by using the cron expression, I believe the cron will allow you to set as low a polling interval as 30 secs. or maybe even lower
Hi Criviere,
If this log has a timestamp in it, you could write a modular input that polls every x minutes for data. Then you use the last timestamp out of the logs in a checkpoint file. On the next run you query the checkpoint time and only get events that are newer. I have done this before and works like a charm.
cheers, MuS