Getting Data In

Monitor Log that changes the first few characters every few minutes causing duplicate indexing of the same log.

gorgiea
Loves-to-Learn

Hello, 

Trying to monitor a log which changes the first few characters of the log every few minutes, this seems to cause Splunk UF to re-index the whole log each time, since it see's the first few characters as being different which causes a difference crc. 

I have tried many different options but nothing seems to be working properly to index this log properly and without duplicates. Example of log below.

 

.log  at 02:53

eÎ5  eÎ5   014500000000000003FGR0002TRA00102021/01/24001202:53 32.0850006

same .log a few minutes later at 02:56

ØT&  ØT&   014500000000000003FGR0002TRA00102021/01/24001202:53 32.0850006
014500000000000003FGR0002TRA00102021/01/24001202:55 42.0150006
014500000000000003FGR0002TRA00102021/01/24001202:56 33.0110006

 

Seems the App that generates this log changes these characters for some reason and there is no way to capture the data without getting duplicate data. Any suggestions? Thanks

 

 

Labels (3)
Tags (2)
0 Karma