topic How to index file with same name and similar content? in Getting Data In

How to index file with same name and similar content?

goonie — Thu, 01 Oct 2020 18:27:42 GMT

I am trying to read a file that gets replaced once in every 24 hours and has the same exact name and has almost similar data.

File name is like :

e:\abcd-app-files\data-translation.txt

Since the data in the file is almost similar everyday, I want to use crcSalt, but crcSalt=<SOURCE> will not work, since my file has the same name every day.

Is there a way to add a dynamic string (maybe a timestamp) to the crcSalt ? so that splunk willread the file everytime even with similar data and same name.

NOTE : I can't change the name of the file to have a timestamp in it. Also, the file content doesn't consist a timestamp inside the data.

Re: How to index file with same name and similar content?

thambisetty — Thu, 01 Oct 2020 18:55:52 GMT

Try below in props.conf on the server (this will work even in uf)

CHECK_METHOD = modtime

Re: How to index file with same name and similar content?

isoutamo — Thu, 01 Oct 2020 19:09:06 GMT

Try to increase initCrcLength to cover enough long part of content to found differences from file.
If nothing else didn’t help you could use scripted input.
r. Ismo