Getting Data In

Monitor Log that changes the first few characters every few minutes causing duplicate indexing of the same log.

gorgiea
Loves-to-Learn

Hello, 

Trying to monitor a log which changes the first few characters of the log every few minutes, this seems to cause Splunk UF to re-index the whole log each time, since it see's the first few characters as being different which causes a difference crc. 

I have tried many different options but nothing seems to be working properly to index this log properly and without duplicates. Example of log below.

 

.log  at 02:53

eÎ5  eÎ5   014500000000000003FGR0002TRA00102021/01/24001202:53 32.0850006

same .log a few minutes later at 02:56

ØT&  ØT&   014500000000000003FGR0002TRA00102021/01/24001202:53 32.0850006
014500000000000003FGR0002TRA00102021/01/24001202:55 42.0150006
014500000000000003FGR0002TRA00102021/01/24001202:56 33.0110006

 

Seems the App that generates this log changes these characters for some reason and there is no way to capture the data without getting duplicate data. Any suggestions? Thanks

 

 

Labels (3)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...