Getting Data In

Splunk as a simple indexer

bulliarda
Explorer

We have a requirement to index a DFS folder containing a lot of subfolders and files from different servers. The goal is to be able to do simple keywords based search against these logs. The logs are different in format, so we will not try to add knowledge by extracting fields. The questions we have are: 1) can we configure Splunk to give the indexing time as the timestamp to an event? We do not want to let him calculate the event timestamp. 2) can we schedule when Splunk has to do the indexing? We would like to run it once per hour, we don't need real time. 3) do you have any tips to apply when you index a lot of files and folders, with many subfolders?

I know it is not really what Splunk is for, but the goal is to have the same tool to do different research and Splunk is now THE tool for log analysis. If he is not able to do this "simple" thing, people would not understand.

Many thanks for your inputs.

0 Karma
1 Solution

ziegfried
Influencer

1) Can be configured in props.conf

[your_sourcetype]
DATETIME_CONFIG=CURRENT

You have to reference the sourcetype in your inputs.conf as well:

[montior:///path/to/monitored/directory]
sourcetype = your_sourcetype

2) No, there is no way to configure a schedule for file monitoring in Splunk.

View solution in original post

ziegfried
Influencer

1) Can be configured in props.conf

[your_sourcetype]
DATETIME_CONFIG=CURRENT

You have to reference the sourcetype in your inputs.conf as well:

[montior:///path/to/monitored/directory]
sourcetype = your_sourcetype

2) No, there is no way to configure a schedule for file monitoring in Splunk.

bulliarda
Explorer

Perfect! Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...