Monitor Log that changes the first few characters every few minutes causing duplicate indexing of the same log.

gorgiea — Sun, 24 Jan 2021 20:01:37 GMT

Hello,

Trying to monitor a log which changes the first few characters of the log every few minutes, this seems to cause Splunk UF to re-index the whole log each time, since it see's the first few characters as being different which causes a difference crc.

I have tried many different options but nothing seems to be working properly to index this log properly and without duplicates. Example of log below.

.log at 02:53

eÎ5 eÎ5 014500000000000003FGR0002TRA00102021/01/24001202:53 32.0850006

same .log a few minutes later at 02:56

ØT& ØT& 014500000000000003FGR0002TRA00102021/01/24001202:53 32.0850006
014500000000000003FGR0002TRA00102021/01/24001202:55 42.0150006
014500000000000003FGR0002TRA00102021/01/24001202:56 33.0110006

Seems the App that generates this log changes these characters for some reason and there is no way to capture the data without getting duplicate data. Any suggestions? Thanks

topic Monitor Log that changes the first few characters every few minutes causing duplicate indexing of the same log. in Getting Data In

Monitor Log that changes the first few characters every few minutes causing duplicate indexing of the same log.