Getting Data In

How to index file with same name and similar content?

goonie
Explorer

I am trying to read a file that gets replaced once in every 24 hours and has the same exact name and has almost similar data.  

File name is like : 

e:\abcd-app-files\data-translation.txt

 

Since the data in the file is almost similar everyday, I want to use crcSalt, but crcSalt=<SOURCE> will not work, since my file has the same name every day. 

Is there a way to add a dynamic string (maybe a timestamp) to the crcSalt ? so that splunk willread the file everytime even with similar data and same name. 

 

NOTE : I can't change the name of the file to have a timestamp in it. Also, the file content doesn't consist a timestamp inside the data. 

Labels (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

Try below in props.conf on the server (this will work even in uf)

 CHECK_METHOD = modtime

 

————————————
If this helps, give a like below.

View solution in original post

isoutamo
SplunkTrust
SplunkTrust
Try to increase initCrcLength to cover enough long part of content to found differences from file.
If nothing else didn’t help you could use scripted input.
r. Ismo
0 Karma

thambisetty
SplunkTrust
SplunkTrust

Try below in props.conf on the server (this will work even in uf)

 CHECK_METHOD = modtime

 

————————————
If this helps, give a like below.
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...