The eval md5 command is for calculating a digest on a field indexed / extracted in your events.You can't pass a file path to digest the file contents.
For a quick solution , what I would try is using the Command Modular Input and utilizing a system command such as "md5sum" to periodically get a digest of your target archive files (whether they are local or remote files) and indexing the computed digest and file information. You can then run your searches over this to compare your archive files across deployment environments over time.
Of course , you could also write your own dedicated Modular Input to accomplish this task also ie: if you wanted to implement the digest algorithm programatically rather than rely on a system command.
thanks for the response.
i am getting an exception in the configure input screen.
"Encountered the following error while trying to save: In handler 'command': Command name md5sum does not exist"
As per the documentation here , http://apps.splunk.com/app/1553/ :
1) download it
2) extract to $SPLUNK_HOME/etc/apps
3) restart Splunk
4) browse to Data Inputs manager page , as shown above.
5) configure your input , example shown above.
Hi Could you please let me know on how to use the Command Modular input.
I was not able to find any details documentation on how to use it.
i found that it was a TA and i was not sure on how to reach the command screen as shown in the screen shot.