Splunk, monitor file changes and MD5 checksum

[cyrillefranchet]

Hi all,

I'm trying to index a log file which consists of some counters. This file doesn't change a lot as counters are just incremented.

As the file size is around 1kB , I have tried to use CHECK_METHOD=entire_md5 to avoid the 256 first bytes and 256 last bytes problem. But the monitor doesn't work so well...

I'm suspecting Splunk to keep hash results somewhere , because my universal forwarder doesn't want to send the log content if the log file has already have the same content.

Maybe anyone can explain the monitor MD5 stuff more deeply? The best solution for me would be to tell Splunk to not keep those hashes.

Thank you.

Cyrille

[Ayn]

You most likely need to add crcSalt = <SOURCE> to your input definition. See more info in these questions/answers:

http://splunk-base.splunk.com/answers/1851/filename-was-different-therefore-source-is-not-indexed-wh...

http://splunk-base.splunk.com/answers/7824/index-monitored-file-initially

[cyrillefranchet]

Hello Ayn,

Nice try but the file name never changes so the crcSalt is not useful. Splunk continues to retain the previous hashes.

Another idea maybe?