Getting Data In

Monitoring a folder

indikaw
Explorer

We are talking about the Splunk capability of monitoring any type of logs. I am having a gunieune issue to to monitor Splunk activity on a partucar folder. I got a folder with large number of files in it that I have told Splunk to monitor once. But how do I know when it's started and when it has stopped. Also to make sure Splunk has indexed all of them successfully. This looks to be a simple question. But can anyone has experience on this and appreciate an answer. I have asked this before and didn't hear anything.

Tags (2)
0 Karma

Ayn
Legend

It's a simple enough question, but not very common because Splunk is most often not used for reading files/directories a single time like that so it's hard to say when it's "done" if it's monitoring a file that's being continuously updated.

That said, you could use the TailingProcessor:FileStatus endpoint to check the status of various monitors. Better yet, use amrit's script that does this for you and makes it look a bit nicer: http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...