Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

How exactly does upload file for one shot indexing work?

$
0
0

I am clear of steps needed for uploading a .tar file but I have a question about how does it work. Splunk indexes the file eventually and stores it in the database which isn't easily human readable. Path to indexes can be configured in splunk settings. Knowing this, my queries are:

  1. When you upload of file of say 10 MB on the remote splunk server, where is it stored? i tried $SPLUNK_HOME/var/spool/splunk immediately after uploading the file. There was no file in it.
  2. Do we have a way to configure where the uploaded file is stored?
  3. Does the file get eventually deleted on the remote server?
  4. If logs from a different date are uploaded later which have still got the already indexed data is that repetition handled?

Thanks!


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>