index same file but where the file name is different in splunk

[surekhasplunk]

Hi,

I am currenlty monitoring ///asbc/logs/*.log

and this folder gets updated everyday with a file called myfile_ddmmyyyy.log

But since the many a days there is no change or update in the log file it doesn't get indexed. 

I am using crcSalt also but no luck. its not getting indexed. Please help

disabled = false
index = abc
sourcetype = _json
crcSalt = <SOURCE>

[isoutamo]

Hi

if the file not exists or it’s content is empty there is nothing to index to splunk. Splunk can only index those events not just filenames.

Or was the situation that there are those files with different content and they still didn’t indexed to splunk?

An additional comment as you are using sourcetype _json, the best practices is define your own sourcetype for json based event not use this “example” sourcetype.

r. Ismo

[venkateshparank]

@surekhasplunk  You have log file myfile_ddmmyyyy.log under /asbc/logs/*.log on server and you have given below stanza right ? Please check if you gave below stanza in inputs.conf

[monitor:///asbc/logs/*.log]
disabled = 0
crcSalt = <SOURCE>
sourcetype = _json
index = abc

Please check below once above stanza is added:

1) Are you using deployment server ? If yes, make sure you have added the server in serverclass.conf
2) Make sure the deployment server details are corret in deploymentclient.conf
3) Make sure the Splunk Forwarder is up and running. Try restart
4) Verify if the port 8089 is open
5) Verify you are able to connect to deployement server through 8089 using telnet from server