Getting Data In

How to index file with same name and similar content?

goonie
Explorer

I am trying to read a file that gets replaced once in every 24 hours and has the same exact name and has almost similar data.  

File name is like : 

e:\abcd-app-files\data-translation.txt

 

Since the data in the file is almost similar everyday, I want to use crcSalt, but crcSalt=<SOURCE> will not work, since my file has the same name every day. 

Is there a way to add a dynamic string (maybe a timestamp) to the crcSalt ? so that splunk willread the file everytime even with similar data and same name. 

 

NOTE : I can't change the name of the file to have a timestamp in it. Also, the file content doesn't consist a timestamp inside the data. 

Labels (2)
0 Karma
1 Solution

thambisetty
Super Champion

Try below in props.conf on the server (this will work even in uf)

 CHECK_METHOD = modtime

 

————————————
If this helps, give a like below.

View solution in original post

isoutamo
SplunkTrust
SplunkTrust
Try to increase initCrcLength to cover enough long part of content to found differences from file.
If nothing else didn’t help you could use scripted input.
r. Ismo
0 Karma

thambisetty
Super Champion

Try below in props.conf on the server (this will work even in uf)

 CHECK_METHOD = modtime

 

————————————
If this helps, give a like below.
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...