Getting Data In

Reindex linux log file

TheBravoSierra
Path Finder

I need to index a file: /var/log/file.txt. This file runs every day, but sometimes the content doesn't change. This leaves me with no events on days that remain the same. I need it to index every time the timestamp changes on the file. I believe I need to add crcSalt =<SOURCE> to the inputs.conf in order to reindex it. However, my inputs monitors all files in /var/log. So if I add that to that input monitor, it would likely apply to all files in var log reindexing them all every time. Something I don't want. How can I reindex just this file daily while leaving the other files in the directory unchanged? 

Many thanks

Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Create a separate inputs.conf stanza for /var/log/file.txt with crcSalt. Then blacklist file.txt from original /var/log monitoring stanza.

View solution in original post

somesoni2
Revered Legend

Create a separate inputs.conf stanza for /var/log/file.txt with crcSalt. Then blacklist file.txt from original /var/log monitoring stanza.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Introducing .conf Stories Series!

“.conf Stories” Series – First Feature: Rich Mahlerwein   Every year .conf brings together some of the most ...