Getting Data In

How to continuously monitor a file in splunk even though it is not updated

shreyasathavale
Communicator

I want to monitor a cfg/csv file daily. The file does not get updated daily, it gets updated once a month or once a quarter.
Can splunk monitor/read the file daily so that i don't have to specify timestamp like earliest=30d or earliest=90d

File does not have a datetime stamp in it.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

A monitor input will read changes to files as they happen. Splunk will read your csv file in its entirety the first time it is seen and then will read only new data every month or quarter.

To read the file every day, consider writing a python script that reads the file and writes it to stdout. Then set up that script as a scripted input scheduled daily. Keep in mind reading the same data every day will increase your license consumption and put duplicated data into your index.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

A monitor input will read changes to files as they happen. Splunk will read your csv file in its entirety the first time it is seen and then will read only new data every month or quarter.

To read the file every day, consider writing a python script that reads the file and writes it to stdout. Then set up that script as a scripted input scheduled daily. Keep in mind reading the same data every day will increase your license consumption and put duplicated data into your index.

---
If this reply helps you, Karma would be appreciated.
0 Karma

oscar84x
Contributor

How are you currently inputting the data from the file into Splunk? Are you doing a monitor stanza in inputs.comf? That's all you should need.

0 Karma

shreyasathavale
Communicator

yeah, but wanted to continuously monitor it

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...