How to monitor contents of the same file but the file will be replaced daily?

[_pravin]

Hi,

I have a use-case where I need to monitor the contents of a file that will be replaced on a daily basis (name will be the same) but data within the file keeps changing.
I developed a script to automate that replaces the contents on the file over a specific interval and had set up the forwarder accordingly.
The contents keep changing but the forwarder is not able to read the newly updated changes within the file, is there some way this could be achieved in Splunk where I could read the contents of the updating file whose name remains the same throughout its lifetime.

Thanks,
Pravin

[isoutamo · Accepted solution]

Hi

here is one old answers from @gcusello which cover your issue https://community.splunk.com/t5/Deployment-Architecture/Index-File-Daily/m-p/292469

r. Ismo

[_pravin]

Thanks, @isoutamo  for the link to the previous answer. But I tried an alternative where I developed a script to delete the existing file and then have it replaced with the file of the same name. The forwarder was now able to read the updated file and also the changes within it.

Regards,

Pravin