Deployment Architecture

Index File Daily

duffeysplunk
Path Finder

I have some files that I need to index daily even though they may not change in content for several days (for example over weekends). The files are generated daily so they have a new creation and modification time. How can I force splunk to automatically index the file daily or use something like creation or modification time?

Tags (2)
0 Karma
1 Solution

gcusello
Legend

Hi duffeysplunk,
you have to insert in your inputs.conf the option crcSalt = <SOURCE> and in your props.conf CHECK_METHOD = modtime.
See
http://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Inputsconf
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

Bye.
Giuseppe

View solution in original post

Rajeev
Loves-to-Learn Lots

Hello,

Won't CHECK_METHOD=modtime lead to duplicate entries in splunk indexer as same data might get indexed again & again daily?

0 Karma

gcusello
Legend

Hi duffeysplunk,
you have to insert in your inputs.conf the option crcSalt = <SOURCE> and in your props.conf CHECK_METHOD = modtime.
See
http://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Inputsconf
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

Bye.
Giuseppe

duffeysplunk
Path Finder

Thanks, that helped. I think I was mostly confused about where I put the CHECK_METHOD.

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...