Splunk Search

How to monitor contents of the same file but the file will be replaced daily?

_pravin
Communicator

Hi,

I have a use-case where I need to monitor the contents of a file that will be replaced on a daily basis (name will be the same) but data within the file keeps changing.
I developed a script to automate that replaces the contents on the file over a specific interval and had set up the forwarder accordingly.
The contents keep changing but the forwarder is not able to read the newly updated changes within the file, is there some way this could be achieved in Splunk where I could read the contents of the updating file whose name remains the same throughout its lifetime.

Thanks,
Pravin

Labels (2)
Tags (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

isoutamo
SplunkTrust
SplunkTrust

Hi

here is one old answers from @gcusello which cover your issue https://community.splunk.com/t5/Deployment-Architecture/Index-File-Daily/m-p/292469

r. Ismo

_pravin
Communicator

Thanks, @isoutamo  for the link to the previous answer. But I tried an alternative where I developed a script to delete the existing file and then have it replaced with the file of the same name. The forwarder was now able to read the updated file and also the changes within it.

 

Regards,

Pravin

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...