Hello,
Trying to monitor a log which changes the first few characters of the log every few minutes, this seems to cause Splunk UF to re-index the whole log each time, since it see's the first few characters as being different which causes a difference crc.
I have tried many different options but nothing seems to be working properly to index this log properly and without duplicates. Example of log below.
.log at 02:53
eÎ5 eÎ5 014500000000000003FGR0002TRA00102021/01/24001202:53 32.0850006
same .log a few minutes later at 02:56
ØT& ØT& 014500000000000003FGR0002TRA00102021/01/24001202:53 32.0850006
014500000000000003FGR0002TRA00102021/01/24001202:55 42.0150006
014500000000000003FGR0002TRA00102021/01/24001202:56 33.0110006
Seems the App that generates this log changes these characters for some reason and there is no way to capture the data without getting duplicate data. Any suggestions? Thanks
