How to continuously monitor a file in splunk even though it is not updated

[shreyasathavale]

I want to monitor a cfg/csv file daily. The file does not get updated daily, it gets updated once a month or once a quarter.
Can splunk monitor/read the file daily so that i don't have to specify timestamp like earliest=30d or earliest=90d

File does not have a datetime stamp in it.

[richgalloway · Accepted solution]

A monitor input will read changes to files as they happen. Splunk will read your csv file in its entirety the first time it is seen and then will read only new data every month or quarter.

To read the file every day, consider writing a python script that reads the file and writes it to stdout. Then set up that script as a scripted input scheduled daily. Keep in mind reading the same data every day will increase your license consumption and put duplicated data into your index.

[oscar84x]

How are you currently inputting the data from the file into Splunk? Are you doing a monitor stanza in inputs.comf? That's all you should need.

[shreyasathavale]

yeah, but wanted to continuously monitor it