Hoping that someone has seen this before and might be able to help.
I'm fairly new to SPLUNK and I am attempting to send to the indexer a monitored file. This log file overwrites itself throughout the day at random periods based upon the software that generates it. I need to be able to have the file read and the contents pushed to the indexer. I need to make sure that we do not get duplicate values nor miss data from within the file.
We are utilizing SPLUNK 6.1 and the Windows Universal Forwarder to monitor the file. Any insight on the best practice for this scenario would be greatly appreciated.
Thanks.
A standard file monitor
-based inputs.conf
entry should work just fine. It may give you some warm fuzzies to use a batch
-based entry to have Splunk delete the file once it is forwarded if it comes in all at once (e.g. FTP) .