topic Re: Send data from file even if there is no change in Getting Data In

Send data from file even if there is no change

shreyasathavale — Mon, 24 Feb 2020 09:09:30 GMT

I have a file in a directory, whose timestamp is changed everyday using "touch" command. The contents might change after 3 months but not daily.
I need to monitor this file in splunk and read the contents even if they are same.

Re: Send data from file even if there is no change

manjunathmeti — Mon, 24 Feb 2020 11:22:07 GMT

In props.conf set CHECK_METHOD = modtime for the source to check the modification time of the file.

props.conf

 [source::<file_path>]
 CHECK_METHOD = modtime

Re: Send data from file even if there is no change

shreyasathavale — Mon, 24 Feb 2020 12:50:18 GMT

I tried this but somehow it is not working

Re: Send data from file even if there is no change

manjunathmeti — Mon, 24 Feb 2020 13:43:35 GMT

can you post inputs.conf and props.conf for this source?

Re: Send data from file even if there is no change

shreyasathavale — Wed, 30 Sep 2020 04:19:44 GMT

Hi, these are the conf files
Inputs.conf is:
[monitor://D:\splunk\abc.csv]
disabled = false
index = main
sourcetype = abccsv

Props.conf:
[labccsv]
BREAK_ONLY_BEFORE = \d\d?:\d\d:\d\d
DATETIME_CONFIG =
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Application
description = Output produced by any Java 2 Enterprise Edition (J2EE) application server using log4j
disabled = false
maxDist = 75
pulldown_type = true
CHECK_METHOD = modtime

Re: Send data from file even if there is no change

manjunathmeti — Mon, 24 Feb 2020 13:56:52 GMT

CHECK_METHOD = modtime must be set for [source:] stanza only not sourcetype.

Add this to props.conf.

[source::D:\splunk\abc.csv]
CHECK_METHOD = modtime

Re: Send data from file even if there is no change

shreyasathavale — Mon, 24 Feb 2020 14:53:08 GMT

That did the trick !!! Thanks!!