Getting Data In

Monitor Log that changes the first few characters every few minutes causing duplicate indexing of the same log.

gorgiea
Loves-to-Learn

Hello, 

Trying to monitor a log which changes the first few characters of the log every few minutes, this seems to cause Splunk UF to re-index the whole log each time, since it see's the first few characters as being different which causes a difference crc. 

I have tried many different options but nothing seems to be working properly to index this log properly and without duplicates. Example of log below.

 

.log  at 02:53

eÎ5  eÎ5   014500000000000003FGR0002TRA00102021/01/24001202:53 32.0850006

same .log a few minutes later at 02:56

ØT&  ØT&   014500000000000003FGR0002TRA00102021/01/24001202:53 32.0850006
014500000000000003FGR0002TRA00102021/01/24001202:55 42.0150006
014500000000000003FGR0002TRA00102021/01/24001202:56 33.0110006

 

Seems the App that generates this log changes these characters for some reason and there is no way to capture the data without getting duplicate data. Any suggestions? Thanks

 

 

Labels (3)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...