Monitor files and directories using Splunk Light

Use Monitor to get data in when the file or directory updates and you want to continue to index the data as it updates. You can also monitor mounted or shared directories, including network file systems. If the specified directory contains subdirectories, the monitor function recursively examines them for new files.

For Windows data inputs, you can use monitor to add data from Windows event logs, Windows registry, Windows performance monitoring, and Active Directory logs.

Select the data source

1. In the Add Data view, click Monitor.

2. Select Files & Directories to view the configuration options.

3. Next to File or Directory, type in or Browse for the directory path.

4. Choose how to monitor the data input:

• Continuously monitor configures an ongoing data input. This means that Splunk Light monitors the file or directory for updates and indexes the updates.
• Index once copies the data into the Splunk Light index.

5. (Optional) For directory inputs, you can specify a whitelist and blacklist to indicate files you want to include and exclude when indexing the data. Use regular expressions to match these files.

6. Click Next to continue.

Data preview

For file inputs, after you define the source, you have an additional Set source type step. This step lets you preview the data before it is indexed, customize the source type, and adjust the event breaks, timestamp, and other settings.

For directory inputs, you do not have data preview. You can set the source type in Input Settings.

Specify input settings

1. Next to Source Type, click Automatic for Splunk Light to assign the source type, click Select to choose from a list of predefined source types, or click Manual to type in a custom source type.

2. (Optional) Override the automatic Host field value assignment with a custom Constant value, Regular expression on path, or Segment in path.

3. (Optional) Specify a different Index to save the data.

You can Create a new index and refresh the list of indexes. By default all data saves to the default main index.

4. Click Review to continue.

Review and Save

1. Review the summary of your data input.

2. (Optional) Go back, to make changes.

3. Click Submit to complete the add data process.