Archive

Index File Daily

Path Finder

I have some files that I need to index daily even though they may not change in content for several days (for example over weekends). The files are generated daily so they have a new creation and modification time. How can I force splunk to automatically index the file daily or use something like creation or modification time?

Tags (2)
0 Karma
1 Solution

Legend

Hi duffeysplunk,
you have to insert in your inputs.conf the option crcSalt = <SOURCE> and in your props.conf CHECK_METHOD = modtime.
See
http://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Inputsconf
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

Bye.
Giuseppe

View solution in original post

0 Karma

Legend

Hi duffeysplunk,
you have to insert in your inputs.conf the option crcSalt = <SOURCE> and in your props.conf CHECK_METHOD = modtime.
See
http://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Inputsconf
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

Bye.
Giuseppe

View solution in original post

0 Karma

Path Finder

Thanks, that helped. I think I was mostly confused about where I put the CHECK_METHOD.

0 Karma