https://community.splunk.com/t5/Getting-Data-In/Monitoring-Cumulative-Dumps/m-p/20492#M3000 <P>When monitoring an EMC Clarion, the CLI tool to dump the logs simply dumps all logs from the device, including any previously exported logs from the previous run. We intend to run the tool every hour and have the tool dump the logs to the same file. So each hour, the file will be overwritten with it's current data, plus any new logs. For instance:</P> <P>Hour 1 (/test/log.txt): event1 Hour 2 (overwritten /test/log.txt): event1 event2 Hour 3 (overwritten /test/log.txt): event1 event2 event3</P> <P>What is the recommended way to index this file?</P> Tue, 27 Jul 2010 01:23:44 GMT Ron_Naken 2010-07-27T01:23:44Z https://community.splunk.com/t5/Getting-Data-In/Monitoring-Cumulative-Dumps/m-p/20492#M3000 <P>When monitoring an EMC Clarion, the CLI tool to dump the logs simply dumps all logs from the device, including any previously exported logs from the previous run. We intend to run the tool every hour and have the tool dump the logs to the same file. So each hour, the file will be overwritten with it's current data, plus any new logs. For instance:</P> <P>Hour 1 (/test/log.txt): event1 Hour 2 (overwritten /test/log.txt): event1 event2 Hour 3 (overwritten /test/log.txt): event1 event2 event3</P> <P>What is the recommended way to index this file?</P> Tue, 27 Jul 2010 01:23:44 GMT https://community.splunk.com/t5/Getting-Data-In/Monitoring-Cumulative-Dumps/m-p/20492#M3000 Ron_Naken 2010-07-27T01:23:44Z https://community.splunk.com/t5/Getting-Data-In/Monitoring-Cumulative-Dumps/m-p/20493#M3001 <P>Splunk creates CRC hashes of the first and last 256 bytes of any file it monitors. Do your cumulative dumps change the beginning of the file, or is that data always the same? If it stays the same, setting up a simple <A href="http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories" rel="nofollow">monitor stanza</A> will be enough to index only the new events added to the file by your dumps.</P> Tue, 27 Jul 2010 03:23:31 GMT https://community.splunk.com/t5/Getting-Data-In/Monitoring-Cumulative-Dumps/m-p/20493#M3001 ftk 2010-07-27T03:23:31Z