Getting Data In

How to index file with same name and similar content?

goonie
Explorer

I am trying to read a file that gets replaced once in every 24 hours and has the same exact name and has almost similar data.  

File name is like : 

e:\abcd-app-files\data-translation.txt

 

Since the data in the file is almost similar everyday, I want to use crcSalt, but crcSalt=<SOURCE> will not work, since my file has the same name every day. 

Is there a way to add a dynamic string (maybe a timestamp) to the crcSalt ? so that splunk willread the file everytime even with similar data and same name. 

 

NOTE : I can't change the name of the file to have a timestamp in it. Also, the file content doesn't consist a timestamp inside the data. 

Labels (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

Try below in props.conf on the server (this will work even in uf)

 CHECK_METHOD = modtime

 

————————————
If this helps, give a like below.

View solution in original post

isoutamo
SplunkTrust
SplunkTrust
Try to increase initCrcLength to cover enough long part of content to found differences from file.
If nothing else didn’t help you could use scripted input.
r. Ismo
0 Karma

thambisetty
SplunkTrust
SplunkTrust

Try below in props.conf on the server (this will work even in uf)

 CHECK_METHOD = modtime

 

————————————
If this helps, give a like below.
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...