About arthurf

arthurf · ‎07-02-2019

Thanks for the confirmation. Have a good day.

arthurf · ‎07-01-2019

Ok, so if get you correctly, it's not possible to prevent the indexation of the same file with batch stanza ? And we need to ensure that the same log file is not generated twice, right ?

arthurf · ‎07-01-2019

The move_policy is set. Here my actual configuration : [batch://FOLDER/Pattern] sourcetype = fluxeditique:cabestan:dtr:in:planapurement3 index=cabestan initCrcLength = 2000 move_policy = sinkhole I replaced "crcSalt = " with "initCrcLength = 2000" but the result is the same.

arthurf · ‎07-01-2019

Hello, I set up my batch stanza to delete the file once indexed, but sometime, the file can't be due to permission error and the same file is indexed multiple time. I used both of the following options: initCrcLength = 2000 crcSalt = But the same file is still indexed again. How can I set up the stanza not to read the same file? Is that possible with batch stanza which deletes the files? (move_policy = sinkhole)

arthurf · ‎05-13-2019

Hello, I was looking for an addon for Visual TOM log but couldn't find it in the SplunkBase. Does someone found one for that ?

arthurf · ‎01-31-2019

Thanks for the confirmation !

arthurf · ‎01-31-2019

That's what I thought. Thanks anyway for your answer. Update : Another workaroud would be to generate one file by event with the ID in the filename in order to salt the filename. But can Splunk delete files which it didn't index ? Since the 'correct' files are deleted after indexing, I don't want to have the 'incorrect' one to stack on the folder.

arthurf · ‎01-30-2019

Hello, I'm looking for a way to not index an event if the ID is already in the index. The log will have this format : Unique ID;data;data2;etc.. Unique ID2;data3;data4;etc.. but two different log files may contain the same event. Is there a way to use the Unique ID as a salt ?

arthurf · ‎11-20-2018

Hello, I'm monitoring a folder to index files and I search to run a script on the file once detected before the indexation. The solution I found is to setup the stanza as 'script' but it imply to choose a schedule for the script. I prefer to have the script executed on file detection, is that possible ? Thanks in advance.

Posts	9
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎11-20-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to set up a stanza batch to index same file?

Is there an addon for VTOM ?

Indexing salt on ID value

Run script at indexation

Re: How to set up a stanza batch to index same fil...

Re: How to set up a stanza batch to index same fil...

Re: How to set up a stanza batch to index same fil...

How to set up a stanza batch to index same file?

Is there an addon for VTOM ?

Re: Indexing salt on ID value

Re: Indexing salt on ID value

Indexing salt on ID value

Run script at indexation