How to reindex rotate log file (rotation)?

[giulioBalza]

Hi everybody,

i know this question was posted lot of time, but i'm not able to find help from the previous post.

I have to index a csv file that every night is rotated/overwritten (same name, same folder) even if it has

the same contents.

In the inputs.conf i have set crcSalt = <SOURCE>

unfortunately the newly files are not loaded, i'm missing additional setting ?

Thanks

G.

[giulioBalza]

Ciao Giuseppe,

how can i set the conf file to get log file re-indexed ?

thanks,

G.

[gcusello]

Hi @giulioBalza,

the check is on the filename, if you rename the file it will be reindexed (using crcSalt).

Ciao.

Giuseppe

[gcusello]

Hi @giulioBalza,

did you tried to not use crcSalt?

this option is useful to input logs from files that contain the same logs with different names, if you have the same name you don'r index it, even if you have new logs.

Ciao.

Giuseppe

[giulioBalza]

Hi @gcusello ,

thank you for the answer, my outcome is to reindex the log file even if it is equal to the previous one.

Regards,

G.

[gcusello]

Hi @giulioBalza,

the crcSalt runs if you have a different file name.

ciao.

Giuseppe

[giulioBalza · Accepted solution]

i have found a solution adding the following lines to props.conf

[source::<full-pathname>]
CHECK_METHOD = modtime

in this way the timestamp is used instead of file name.

thanks @gcusello to address me.

Regards,

G.

[gcusello]

Hi @giulioBalza,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉