Getting Data In
Highlighted

How to monitor a structured XML log file without indexing duplicate events?

Contributor

Hi forum,

I'm trying to monitor an xml structured logfile like this:

<Events>
<Event>line1</Events>
<Event>line2</Events>
</Events>

When a new event is coming in, the new logentry tag is attached one line before the end.

<Events>
<Event>line1</Events>
<Event>line2</Events>
<Event>line3</Events>
</Events>

When using monitor://, the logfile is re-read completely and I end up in doubled events for every new line. The message I see in splunkd.log on the forwarder is

Checksum for seekptr didn't match, will re-read entire file file='/logs/example.logs'

Workaround to get rid of the doubled events is to logrotate very often and read the rotated log, not the recent. The rotated log will not be extended so the problem doesn't occur.

Is there better way to monitor the recent log? Tried followTail = 1 , but didn't work out.

Best Regards,

Andreas

0 Karma
Highlighted

Re: How to monitor a structured XML log file without indexing duplicate events?

Motivator
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.