Since I usually turned of splunkd service on my local machine and only turn it back on when I need to do some log search.
Chances that when I turn the daemon back on, I will have some more files that needs to be indexed right away for search. Is there any way can make Splunk daemon do this? There may be 2 cases:
Thanks.
The file that is already under a tracked folder should be picked up automatically by splunk as soon as it gets turned on.
To monitor the new file all you have to do is login to splunk, go to manager, then data inputs and then files and directories. There you can tell splunk to monitor the new file and the parsing should start immediately. Follow these breadcrumbs:
Manager » Data inputs » Files & Directories » Add New
The file that is already under a tracked folder should be picked up automatically by splunk as soon as it gets turned on.
To monitor the new file all you have to do is login to splunk, go to manager, then data inputs and then files and directories. There you can tell splunk to monitor the new file and the parsing should start immediately. Follow these breadcrumbs:
Manager » Data inputs » Files & Directories » Add New