topic Re: How to use CHECK_METHOD in Univsersal Forwarder in Splunk Enterprise

How to use CHECK_METHOD in Univsersal Forwarder

sieutruc — Sat, 10 Nov 2012 13:42:28 GMT

Hello all,

I have a big csv file. Sometimes the file is updated in the middle of the file, so the current CRC checking that Splunk uses is not working. So in order to make sure the file be indexed , i want to monitor the change of file by checking its entire MD5. But the problem is we cannot place props on Universal Forwarder.

SO what should i do ?

Another small question is CHECK_METHOD=modtime . What does modtime mean ? Doest the file be indexed when its date modification is changed, no mattter its content is changed or not ?

Re: How to use CHECK_METHOD in Univsersal Forwarder

gkanapathy — Sun, 11 Nov 2012 05:22:37 GMT

You can put props.conf on the forwarder. CHECK_METHOD would be pretty useless if it didn't work where the input files were located. However, this may not work for you regardless. If you are updating file in the middle, the only way to capture the change is to index the entire file. If that's what you want, then that's fine, but if you're hoping that you can just capture the lines that get modified, Splunk doesn't work that way. Yes, modtime looks at the modification time of the file to decide if it's been changed.

Re: How to use CHECK_METHOD in Univsersal Forwarder

sieutruc — Sat, 17 Nov 2012 11:24:16 GMT

I tried CHECK_METHOD=modtime but it didn't work. Have you tested it before ?

Re: How to use CHECK_METHOD in Univsersal Forwarder

alanden_splunk — Tue, 29 Sep 2020 14:33:48 GMT

CHECK_METHOD=entire_md5 goes into props on UF. The limitation is that some props options do not work on the UF, but this option does work on the UF.

https://answers.splunk.com/answers/104592/ingesting-file-data.html