I am trying to read a file that gets replaced once in every 24 hours and has the same exact name and has almost similar data.
File name is like :
Since the data in the file is almost similar everyday, I want to use crcSalt, but crcSalt=<SOURCE> will not work, since my file has the same name every day. Is there a way to add a dynamic string (maybe a timestamp) to the crcSalt ? so that splunk willread the file everytime even with similar data and same name.
NOTE : I can't change the name of the file to have a timestamp in it. Also, the file content doesn't consist a timestamp inside the data.
Try below in props.conf on the server (this will work even in uf)
CHECK_METHOD = modtime
View solution in original post