Getting Data In

Splunk, monitor file changes and MD5 checksum

cyrillefranchet
Explorer

Hi all,

I'm trying to index a log file which consists of some counters. This file doesn't change a lot as counters are just incremented.

As the file size is around 1kB , I have tried to use CHECK_METHOD=entire_md5 to avoid the 256 first bytes and 256 last bytes problem. But the monitor doesn't work so well...

I'm suspecting Splunk to keep hash results somewhere , because my universal forwarder doesn't want to send the log content if the log file has already have the same content.

Maybe anyone can explain the monitor MD5 stuff more deeply? The best solution for me would be to tell Splunk to not keep those hashes.

Thank you.

Cyrille

Ayn
Legend

You most likely need to add crcSalt = <SOURCE> to your input definition. See more info in these questions/answers:

http://splunk-base.splunk.com/answers/1851/filename-was-different-therefore-source-is-not-indexed-wh...

http://splunk-base.splunk.com/answers/7824/index-monitored-file-initially

0 Karma

cyrillefranchet
Explorer

Hello Ayn,

Nice try but the file name never changes so the crcSalt is not useful. Splunk continues to retain the previous hashes.

Another idea maybe?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...