Getting Data In

How to index duplicate files which has different name

snehalk
Communicator

Hello All,

Is there any application or method in Splunk, where we can index the files(which has same contain) in Splunk but with different file name?

Or Can we identify the duplicate files in Splunk without indexing?

Note: one option is there where we can delete the fishbucket and reindex, but i dont want to go with this option.

Can any one help me on this.

Thanks in Advance.

1 Solution

gcusello
SplunkTrust
SplunkTrust

insert in your inputs.conf stanza the row

crcSalt = <SOURCE>

as described in http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

insert in your inputs.conf stanza the row

crcSalt = <SOURCE>

as described in http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf

Bye.
Giuseppe

snehalk
Communicator

Hello Cusello,

Thank you for quick response, am using below config as suggested by you, and its indexing duplicate files in splunk.

inputs.conf
[monitor://C:\sampleduplicate\duplicatefiles\*]
index=main
sourcetype=vendorduplicate
crcSalt = <SOURCE>

Thank you once again !!

0 Karma

Samir__
Engager

Follow up question on the same topic. I also have files with different name but most of them have exact same contents.

After adding crcSalt = < SOURCE> in inputs.conf, does splunk automatically index previously excluded "duplicates"?

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...