Getting Data In

How to index file with same name and similar content?

goonie
Explorer

I am trying to read a file that gets replaced once in every 24 hours and has the same exact name and has almost similar data.  

File name is like : 

e:\abcd-app-files\data-translation.txt

 

Since the data in the file is almost similar everyday, I want to use crcSalt, but crcSalt=<SOURCE> will not work, since my file has the same name every day. 

Is there a way to add a dynamic string (maybe a timestamp) to the crcSalt ? so that splunk willread the file everytime even with similar data and same name. 

 

NOTE : I can't change the name of the file to have a timestamp in it. Also, the file content doesn't consist a timestamp inside the data. 

Labels (2)
0 Karma
1 Solution

thambisetty
Super Champion

Try below in props.conf on the server (this will work even in uf)

 CHECK_METHOD = modtime

 

————————————
If this helps, give a like below.

View solution in original post

isoutamo
SplunkTrust
SplunkTrust
Try to increase initCrcLength to cover enough long part of content to found differences from file.
If nothing else didn’t help you could use scripted input.
r. Ismo
0 Karma

thambisetty
Super Champion

Try below in props.conf on the server (this will work even in uf)

 CHECK_METHOD = modtime

 

————————————
If this helps, give a like below.

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!