Monitor files and directories in Splunk Enterprise with Splunk Web

You can use Splunk Web to add inputs from files and directories.

Forwarding a file requires additional setup. See the following topics:

• If you work with universal forwarders, see Configure the universal forwarder in the Splunk Universal Forwarder Forwarder Manual.
• If you work with heavy forwarders, see Enable forwarding on a Splunk Enterprise instance in the Forwarding Data manual.

Go to the Add New page

You add an input from the Add Data page in Splunk Web.

You can get there by either of these two ways.

Splunk Settings

1. Click Settings > Data Inputs.
2. Click Files & Directories.
3. Click New to add an input.

Splunk home

1. Click Add Data in Splunk home.
2. Click Upload to upload a file, Monitor to monitor a file, or Forward to forward a file.

Select the input source

1. To add a file or directory input, click Files & Directories in Splunk Web.
2. In the File or Directory field, type the full path to the file or directory.
   To monitor a network drive that you have mounted on the system, enter <myhost>/<mypath> for *nix or \\<myhost>\<mypath> for Windows. Confirm that Splunk Enterprise has read access to the mounted drive, as well as to the files you want to monitor.
3. Choose how you want Splunk Enterprise to monitor the file:
   • Choose Continuously Monitor to set up an ongoing input. Splunk Enterprise monitors the file continuously for new data.
   • Choose Index Once to copy a file on the server into Splunk Enterprise.
4. Click Next.
   If you specified a directory in the File or Directory field, Splunk Enterprise refreshes the screen to show fields for include list and exclude list. These fields let you type regular expressions that Splunk Enterprise then uses to match files for inclusion or exclusion. Otherwise, Splunk Enterprise proceeds to the Set Sourcetype page where you can preview how Splunk Enterprise proposes to index the events.

For more information on how to include and exclude data, see Include or exclude specific incoming data.

Preview your data and set its source type

When you add a new file input, Splunk Enterprise lets you set the source type of your data and preview how the data looks once it is indexed. This lets you check that the data is formatted properly and make any necessary adjustments.

For information about the Set Source Type page, see Apply the correct source types to your data.

If you skip the data preview, the Input Settings page appears.

You cannot preview directories or archived files. You also cannot preview inputs with the Log to Metrics source type.

Specify input settings

You can provide application context, the default host value, and the index in the Input Settings page. All parameters are optional.

1. Select the appropriate Application context for this input.
2. Set the Host value.
   

   The Host value sets only the host field in the resulting events. Setting this value does not direct Splunk Enterprise to look on a specific host on your network.

3. Set the Index that you want Splunk Enterprise to send data to for this input. Leave the value as "default", unless you have defined multiple indexes and want to use one of those instead.
4. Click Review to review all of the choices you have made.

Review your choices

After you provide all input settings, review your selections. Splunk Web lists the options you selected, including the type of monitor, the source, the source type, the application context, and the index.

1. Review the settings.
2. If they do not match what you want, click the left-pointing bracket ( < ) to go back to the previous step in the wizard. Otherwise, click Submit. A Success page appears and the Splunk platform begins indexing the specified file or directory.