Getting Data In
Highlighted

Splunk, monitor file changes and MD5 checksum

Hi all,

I'm trying to index a log file which consists of some counters. This file doesn't change a lot as counters are just incremented.

As the file size is around 1kB , I have tried to use CHECK_METHOD=entire_md5 to avoid the 256 first bytes and 256 last bytes problem. But the monitor doesn't work so well...

I'm suspecting Splunk to keep hash results somewhere , because my universal forwarder doesn't want to send the log content if the log file has already have the same content.

Maybe anyone can explain the monitor MD5 stuff more deeply? The best solution for me would be to tell Splunk to not keep those hashes.

Thank you.

Cyrille

Highlighted

Re: Splunk, monitor file changes and MD5 checksum

Legend

You most likely need to add crcSalt = <SOURCE> to your input definition. See more info in these questions/answers:

http://splunk-base.splunk.com/answers/1851/filename-was-different-therefore-source-is-not-indexed-wh...

http://splunk-base.splunk.com/answers/7824/index-monitored-file-initially

0 Karma
Highlighted

Re: Splunk, monitor file changes and MD5 checksum

Hello Ayn,

Nice try but the file name never changes so the crcSalt is not useful. Splunk continues to retain the previous hashes.

Another idea maybe?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.