Search Reference

 


crawl

NOTE - Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.

crawl

Synopsis

Crawls the filesystem for files of interest to Splunk.

Syntax

crawl [ files | network ] [crawl-option]*

Optional arguments

crawl-option
Syntax: <string>=<string>
Description: Override settings from crawl.conf.

Description

Crawls for the discovery of new sources to index. Default crawl settings are found in crawl.conf and crawl operations are logged to $splunk_home/var/log/splunk/crawl.log. Generally to be used in conjunction with the input command. Specify crawl options to override settings in crawl.conf. Note: If you add crawl to a search, Splunk only returns data it generates from crawl. Splunk doesn't return any data generated before | crawl.

Examples

Example 1: Crawl root and home directories and add all possible inputs found (adds configuration information to "inputs.conf").

| crawl root="/;/Users/" | input add

Example 2: Crawl bob's home directory.

| crawl root=/home/bob

Example 3: Add all sources found in bob's home directory to the 'preview' index.

| crawl root=/home/bob | input add index=preview

Example 4: Crawl using default settings defined in crawl.conf.

| crawl

See also

input

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the crawl command.

This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 4.3.7 , 5.0 , 5.0.1 , 5.0.2 , 5.0.3 , 5.0.4 , 5.0.5 , 5.0.6 , 5.0.7 , 5.0.8 , 5.0.9 , 5.0.10 , 6.0 , 6.0.1 , 6.0.2 , 6.0.3 , 6.0.4 , 6.0.5 , 6.0.6 , 6.1 , 6.1.1 , 6.1.2 , 6.1.3 , 6.1.4 , 6.2.0 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!