Monitoring Splunk

How to re-read the same file again daily

mlevsh
Builder

Hi,
trying to find the best solution (approach) to the following issue:

We are monitoring ( via Splunk Universal forwarder ) the file "Assignment_group.csv" , exported daily from Service Now.
It exports assignment_groups and It has department name, team name, team's manager:
"Our department" , "Our Team", "Our Manager".
We ingest it and use it as lookup for assignment groups in our related dashboards.

If file is not changed - Splunk doesn't index it again , it seems, and as a result - our lookup gets empty.

We thought about using [batch://...] to read the same file instead of [monitor://...] but it deletes the source file and we want to keep it for troubleshooting proposes.

Any advice will be appreciated

0 Karma

gcusello
Legend

Hi @mlevsh,
you have to read the lookup values and use them before overriding the lookup itself, in other words, something like this:

index=my_index
| append [ | inputlookup my_lookup | table field1 field2 field3 ]
| stats values(field2) AS field2 values(field3) AS field3 BY field1
| eval field2=mvindex(field2,0), field3=mvindex(field3,0)
| table field1 field2 field3
| outputlookup my_lookup

where field1 is the key field and field2 and field3 are the fields to upgrade.

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...