I have configured inputs.conf to monitor the log file on the path. Please find below details regarding same:
We have configured inputs.conf on one centralized server where all data gets dump on hourly basis. It creates a new folder on hourly basis (folder name contains) and it contains log file with specific name.
The file name may or may not get changed every time. So every time you may get the same type of data in the log file. And if there is any new entry it will append to that file.
So path would be like below:
Setting I did in inputs.conf
disabled = 0
index = XXXXX
sourcetype = XXXXX
I also tried using *crcSalt = *
Problem: Every time it sends whole file to Splunk and getting duplication of alerts. Ideally it should send only new entry which has not already been sent to the indexer.