topic Re: index same file but where the file name is different in splunk in Getting Data In

index same file but where the file name is different in splunk

surekhasplunk — Sun, 16 Aug 2020 03:08:46 GMT

Hi,

I am currenlty monitoring ///asbc/logs/*.log

and this folder gets updated everyday with a file called myfile_ddmmyyyy.log

But since the many a days there is no change or update in the log file it doesn't get indexed.

I am using crcSalt also but no luck. its not getting indexed. Please help

disabled = false
index = abc
sourcetype = _json
crcSalt = <SOURCE>

Re: index same file but where the file name is different in splunk

venkateshparank — Sun, 16 Aug 2020 07:38:10 GMT

@surekhasplunk You have log file myfile_ddmmyyyy.log under /asbc/logs/*.log on server and you have given below stanza right ? Please check if you gave below stanza in inputs.conf

[monitor:///asbc/logs/*.log]
disabled = 0
crcSalt = <SOURCE>
sourcetype = _json
index = abc

Please check below once above stanza is added:

1) Are you using deployment server ? If yes, make sure you have added the server in serverclass.conf
2) Make sure the deployment server details are corret in deploymentclient.conf
3) Make sure the Splunk Forwarder is up and running. Try restart
4) Verify if the port 8089 is open
5) Verify you are able to connect to deployement server through 8089 using telnet from server

Re: index same file but where the file name is different in splunk

isoutamo — Sun, 16 Aug 2020 11:17:10 GMT

if the file not exists or it’s content is empty there is nothing to index to splunk. Splunk can only index those events not just filenames.

Or was the situation that there are those files with different content and they still didn’t indexed to splunk?

An additional comment as you are using sourcetype _json, the best practices is define your own sourcetype for json based event not use this “example” sourcetype.

r. Ismo