Splunk Enterprise Security

splunk enterprise add data - monitor - how to fetch data in real time

vnarapuram
Explorer

In splunk enterprise security, I am trying to add data from a directory using 'Monitor'. Files gets created in the directory in real time. So, I want to use 'Monitor' and select 'directory' under 'Files & Directories'.
I ingested the data with one file and it was successful and I am able to search event too.
But upon adding new files in the specified directory, should I assume the splunk will read new files as they come in or do I need to do anything else to make splunk read new data from that directory?
Right now, in the 'Select Source' page, I selected 'Continuously Monitor' option but upon adding new files in the direcory splunk is not reading those since I am not ale to search those events.

0 Karma

martynoconnor
Communicator

Does your Splunk system account have permission to read other files in that directory?

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Yes, you are understanding the monitoring concept correctly. If configured correctly, you should not need to do anything else.
New files not being picked up could be caused by a number of issues.
Can you post the contents of your inputs.conf?

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...