Splunk Search

How to monitor contents of the same file but the file will be replaced daily?

_pravin
Contributor

Hi,

I have a use-case where I need to monitor the contents of a file that will be replaced on a daily basis (name will be the same) but data within the file keeps changing.
I developed a script to automate that replaces the contents on the file over a specific interval and had set up the forwarder accordingly.
The contents keep changing but the forwarder is not able to read the newly updated changes within the file, is there some way this could be achieved in Splunk where I could read the contents of the updating file whose name remains the same throughout its lifetime.

Thanks,
Pravin

Labels (1)
Tags (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

isoutamo
SplunkTrust
SplunkTrust

Hi

here is one old answers from @gcusello which cover your issue https://community.splunk.com/t5/Deployment-Architecture/Index-File-Daily/m-p/292469

r. Ismo

_pravin
Contributor

Thanks, @isoutamo  for the link to the previous answer. But I tried an alternative where I developed a script to delete the existing file and then have it replaced with the file of the same name. The forwarder was now able to read the updated file and also the changes within it.

 

Regards,

Pravin

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...