Getting Data In

How to monitor a structured XML log file without indexing duplicate events?

schose
Builder

Hi forum,

I'm trying to monitor an xml structured logfile like this:

<Events>
<Event>line1</Events>
<Event>line2</Events>
</Events>

When a new event is coming in, the new logentry tag is attached one line before the end.

<Events>
<Event>line1</Events>
<Event>line2</Events>
<Event>line3</Events>
</Events>

When using monitor://, the logfile is re-read completely and I end up in doubled events for every new line. The message I see in splunkd.log on the forwarder is

Checksum for seekptr didn't match, will re-read entire file file='/logs/example.logs'

Workaround to get rid of the doubled events is to logrotate very often and read the rotated log, not the recent. The rotated log will not be extended so the problem doesn't occur.

Is there better way to monitor the recent log? Tried followTail = 1 , but didn't work out.

Best Regards,

Andreas

0 Karma
1 Solution
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...