topic How to monitor contents of the same file but the file will be replaced daily? in Splunk Search

How to monitor contents of the same file but the file will be replaced daily?

_pravin — Mon, 25 Apr 2022 15:22:14 GMT

Hi,

I have a use-case where I need to monitor the contents of a file that will be replaced on a daily basis (name will be the same) but data within the file keeps changing.
I developed a script to automate that replaces the contents on the file over a specific interval and had set up the forwarder accordingly.
The contents keep changing but the forwarder is not able to read the newly updated changes within the file, is there some way this could be achieved in Splunk where I could read the contents of the updating file whose name remains the same throughout its lifetime.

Thanks,
Pravin

Re: Monitor contents of the same file but the file will be replaced daily

isoutamo — Mon, 25 Apr 2022 09:20:31 GMT

here is one old answers from @gcusello which cover your issue https://community.splunk.com/t5/Deployment-Architecture/Index-File-Daily/m-p/292469

r. Ismo

Re: Monitor contents of the same file but the file will be replaced daily

_pravin — Wed, 27 Apr 2022 09:35:21 GMT

Thanks, @isoutamo for the link to the previous answer. But I tried an alternative where I developed a script to delete the existing file and then have it replaced with the file of the same name. The forwarder was now able to read the updated file and also the changes within it.

Regards,

Pravin