topic Re: Index File Daily in Deployment Architecture

Index File Daily

duffeysplunk — Thu, 09 Feb 2017 15:51:46 GMT

I have some files that I need to index daily even though they may not change in content for several days (for example over weekends). The files are generated daily so they have a new creation and modification time. How can I force splunk to automatically index the file daily or use something like creation or modification time?

Re: Index File Daily

gcusello — Fri, 10 Feb 2017 09:22:24 GMT

Hi duffeysplunk,
you have to insert in your inputs.conf the option crcSalt = <SOURCE> and in your props.conf CHECK_METHOD = modtime.
See
http://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Inputsconf
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

Bye.
Giuseppe

Re: Index File Daily

duffeysplunk — Fri, 10 Feb 2017 13:16:04 GMT

Thanks, that helped. I think I was mostly confused about where I put the CHECK_METHOD.

Re: Index File Daily

Rajeev — Fri, 11 Jun 2021 08:13:26 GMT

Hello,

Won't CHECK_METHOD=modtime lead to duplicate entries in splunk indexer as same data might get indexed again & again daily?