Deployment Architecture

Index File Daily

duffeysplunk
Path Finder

I have some files that I need to index daily even though they may not change in content for several days (for example over weekends). The files are generated daily so they have a new creation and modification time. How can I force splunk to automatically index the file daily or use something like creation or modification time?

Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi duffeysplunk,
you have to insert in your inputs.conf the option crcSalt = <SOURCE> and in your props.conf CHECK_METHOD = modtime.
See
http://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Inputsconf
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

Bye.
Giuseppe

View solution in original post

Rajeev
Loves-to-Learn Lots

Hello,

Won't CHECK_METHOD=modtime lead to duplicate entries in splunk indexer as same data might get indexed again & again daily?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi duffeysplunk,
you have to insert in your inputs.conf the option crcSalt = <SOURCE> and in your props.conf CHECK_METHOD = modtime.
See
http://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Inputsconf
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

Bye.
Giuseppe

duffeysplunk
Path Finder

Thanks, that helped. I think I was mostly confused about where I put the CHECK_METHOD.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...