Getting Data In

How to continuously monitor a file in splunk even though it is not updated

shreyasathavale
Communicator

I want to monitor a cfg/csv file daily. The file does not get updated daily, it gets updated once a month or once a quarter.
Can splunk monitor/read the file daily so that i don't have to specify timestamp like earliest=30d or earliest=90d

File does not have a datetime stamp in it.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

A monitor input will read changes to files as they happen. Splunk will read your csv file in its entirety the first time it is seen and then will read only new data every month or quarter.

To read the file every day, consider writing a python script that reads the file and writes it to stdout. Then set up that script as a scripted input scheduled daily. Keep in mind reading the same data every day will increase your license consumption and put duplicated data into your index.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

A monitor input will read changes to files as they happen. Splunk will read your csv file in its entirety the first time it is seen and then will read only new data every month or quarter.

To read the file every day, consider writing a python script that reads the file and writes it to stdout. Then set up that script as a scripted input scheduled daily. Keep in mind reading the same data every day will increase your license consumption and put duplicated data into your index.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

oscar84x
Contributor

How are you currently inputting the data from the file into Splunk? Are you doing a monitor stanza in inputs.comf? That's all you should need.

0 Karma

shreyasathavale
Communicator

yeah, but wanted to continuously monitor it

0 Karma