I have a large number of files (going by the thousands) that I only need to index once, and since I want to know when the indexing has completed, I make use of the oneshot adding command in the CLI to do this.
The problem is, Splunk indexes all the files in its oneshot list at the same time (correct me if I'm wrong on this), which makes the indexing exponentially slower as more files are added to the oneshot list.
Adding in a fixed delay in the CLI script is one way to help, but it's not the best solution here.
Is there any way to alter the behaviour of the oneshot indexing to index only one log file after another instead of all at once?
... View more