Installation

Issues with data ingestion from the same xml files with appended data/raw

SplunkDash
Motivator

Hello,

I have xml source files in a location where SPLUNK HF installed on it...these files are updated with new data...that means no new files are created .....when new data comes in... existing files are appended, and new data added at the end of the existing files. I know SPLUNK has CRC to check duplicate entries based on the Hash Function. My question is.... will SPLUNK UF/HF be able to read only new data that is added at the end of existing file without any errors (or missing info) and send to the indexer. 

Any recommendations/thoughts would be highly appreciated. Thank you so much for your support.

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Normally monitor inputs - as the name says - monitor files for changes. If there is data appended to the end of the file, it _should_ be read and ingested. There are some border cases where it fails, often involving sharing files over the network, but in general case - it should work pretty well.

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...