How do you make sure to send logs from a scripted input only when the output is changed?
Lets say the script is doing an "ls" on the file system and runs every minute. I do not want an index to get filled with the same events just with a different time stamp.
How do you make sure that Splunk only forwards data whenever the scripts output is different than the previous output?
If you already wrote a script then at the end of the script take the result of "ls" and write to a file. In the beginning of the script, check that file and only output to STDOUT if there is a difference.
In other words, Splunk can't do this "difference" functionality. Your script will have to do this.
If you already wrote a script then at the end of the script take the result of "ls" and write to a file. In the beginning of the script, check that file and only output to STDOUT if there is a difference.
In other words, Splunk can't do this "difference" functionality. Your script will have to do this.