topic How to reindex rotate log file (rotation)? in Getting Data In

How to reindex rotate log file (rotation)?

giulioBalza — Wed, 09 Nov 2022 15:06:12 GMT

Hi everybody,

i know this question was posted lot of time, but i'm not able to find help from the previous post.

I have to index a csv file that every night is rotated/overwritten (same name, same folder) even if it has

the same contents.

In the inputs.conf i have set crcSalt = <SOURCE>

unfortunately the newly files are not loaded, i'm missing additional setting ?

Thanks

Re: How to reindex rotate log file (rotation)

gcusello — Wed, 09 Nov 2022 09:09:55 GMT

Hi @giulioBalza,

did you tried to not use crcSalt?

this option is useful to input logs from files that contain the same logs with different names, if you have the same name you don'r index it, even if you have new logs.

Ciao.

Giuseppe

Re: How to reindex rotate log file (rotation)

giulioBalza — Wed, 09 Nov 2022 12:13:13 GMT

Hi @gcusello ,

thank you for the answer, my outcome is to reindex the log file even if it is equal to the previous one.

Regards,

Re: How to reindex rotate log file (rotation)

gcusello — Wed, 09 Nov 2022 13:10:12 GMT

Hi @giulioBalza,

the crcSalt runs if you have a different file name.

ciao.

Giuseppe

Re: How to reindex rotate log file (rotation)

giulioBalza — Wed, 09 Nov 2022 13:14:11 GMT

Ciao Giuseppe,

how can i set the conf file to get log file re-indexed ?

thanks,

Re: How to reindex rotate log file (rotation)

gcusello — Wed, 09 Nov 2022 13:50:33 GMT

Hi @giulioBalza,

the check is on the filename, if you rename the file it will be reindexed (using crcSalt).

Ciao.

Giuseppe

Re: How to reindex rotate log file (rotation)

giulioBalza — Thu, 10 Nov 2022 07:56:58 GMT

i have found a solution adding the following lines to props.conf

[source::<full-pathname>]
CHECK_METHOD = modtime

in this way the timestamp is used instead of file name.

thanks @gcusello to address me.

Regards,

Re: How to reindex rotate log file (rotation)

gcusello — Thu, 10 Nov 2022 08:25:05 GMT

Hi @giulioBalza,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉