Installation

Issues with data ingestion from the same xml files with appended data/raw

SplunkDash
Motivator

Hello,

I have xml source files in a location where SPLUNK HF installed on it...these files are updated with new data...that means no new files are created .....when new data comes in... existing files are appended, and new data added at the end of the existing files. I know SPLUNK has CRC to check duplicate entries based on the Hash Function. My question is.... will SPLUNK UF/HF be able to read only new data that is added at the end of existing file without any errors (or missing info) and send to the indexer. 

Any recommendations/thoughts would be highly appreciated. Thank you so much for your support.

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Normally monitor inputs - as the name says - monitor files for changes. If there is data appended to the end of the file, it _should_ be read and ingested. There are some border cases where it fails, often involving sharing files over the network, but in general case - it should work pretty well.

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...