Getting Data In

How to continuously monitor a file in splunk even though it is not updated

shreyasathavale
Communicator

I want to monitor a cfg/csv file daily. The file does not get updated daily, it gets updated once a month or once a quarter.
Can splunk monitor/read the file daily so that i don't have to specify timestamp like earliest=30d or earliest=90d

File does not have a datetime stamp in it.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

A monitor input will read changes to files as they happen. Splunk will read your csv file in its entirety the first time it is seen and then will read only new data every month or quarter.

To read the file every day, consider writing a python script that reads the file and writes it to stdout. Then set up that script as a scripted input scheduled daily. Keep in mind reading the same data every day will increase your license consumption and put duplicated data into your index.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

A monitor input will read changes to files as they happen. Splunk will read your csv file in its entirety the first time it is seen and then will read only new data every month or quarter.

To read the file every day, consider writing a python script that reads the file and writes it to stdout. Then set up that script as a scripted input scheduled daily. Keep in mind reading the same data every day will increase your license consumption and put duplicated data into your index.

---
If this reply helps you, Karma would be appreciated.
0 Karma

oscar84x
Contributor

How are you currently inputting the data from the file into Splunk? Are you doing a monitor stanza in inputs.comf? That's all you should need.

0 Karma

shreyasathavale
Communicator

yeah, but wanted to continuously monitor it

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...