Splunk Search

How to monitor contents of the same file but the file will be replaced daily?

_pravin
Path Finder

Hi,

I have a use-case where I need to monitor the contents of a file that will be replaced on a daily basis (name will be the same) but data within the file keeps changing.
I developed a script to automate that replaces the contents on the file over a specific interval and had set up the forwarder accordingly.
The contents keep changing but the forwarder is not able to read the newly updated changes within the file, is there some way this could be achieved in Splunk where I could read the contents of the updating file whose name remains the same throughout its lifetime.

Thanks,
Pravin

Labels (2)
Tags (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

isoutamo
SplunkTrust
SplunkTrust

Hi

here is one old answers from @gcusello which cover your issue https://community.splunk.com/t5/Deployment-Architecture/Index-File-Daily/m-p/292469

r. Ismo

_pravin
Path Finder

Thanks, @isoutamo  for the link to the previous answer. But I tried an alternative where I developed a script to delete the existing file and then have it replaced with the file of the same name. The forwarder was now able to read the updated file and also the changes within it.

 

Regards,

Pravin

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...