Hi everybody,
i know this question was posted lot of time, but i'm not able to find help from the previous post.
I have to index a csv file that every night is rotated/overwritten (same name, same folder) even if it has
the same contents.
In the inputs.conf i have set crcSalt = <SOURCE>
unfortunately the newly files are not loaded, i'm missing additional setting ?
Thanks
G.
i have found a solution adding the following lines to props.conf
[source::<full-pathname>]
CHECK_METHOD = modtime
in this way the timestamp is used instead of file name.
thanks @gcusello to address me.
Regards,
G.
Ciao Giuseppe,
how can i set the conf file to get log file re-indexed ?
thanks,
G.
Hi @giulioBalza,
the check is on the filename, if you rename the file it will be reindexed (using crcSalt).
Ciao.
Giuseppe
Hi @giulioBalza,
did you tried to not use crcSalt?
this option is useful to input logs from files that contain the same logs with different names, if you have the same name you don'r index it, even if you have new logs.
Ciao.
Giuseppe
Hi @gcusello ,
thank you for the answer, my outcome is to reindex the log file even if it is equal to the previous one.
Regards,
G.
i have found a solution adding the following lines to props.conf
[source::<full-pathname>]
CHECK_METHOD = modtime
in this way the timestamp is used instead of file name.
thanks @gcusello to address me.
Regards,
G.
Hi @giulioBalza,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉