How to index file with same name and similar content?

[goonie]

I am trying to read a file that gets replaced once in every 24 hours and has the same exact name and has almost similar data.  

File name is like : 

e:\abcd-app-files\data-translation.txt

Since the data in the file is almost similar everyday, I want to use crcSalt, but crcSalt=<SOURCE> will not work, since my file has the same name every day. 

Is there a way to add a dynamic string (maybe a timestamp) to the crcSalt ? so that splunk willread the file everytime even with similar data and same name. 

NOTE : I can't change the name of the file to have a timestamp in it. Also, the file content doesn't consist a timestamp inside the data. 

[isoutamo]

Try to increase initCrcLength to cover enough long part of content to found differences from file.
If nothing else didn’t help you could use scripted input.
r. Ismo

[thambisetty · Accepted solution]

Try below in props.conf on the server (this will work even in uf)

 CHECK_METHOD = modtime