Getting Data In

What is the best way to use a universal forwarder to monitor a file that overwrites itself at random periods throughout the day?

rfoley
New Member

Hoping that someone has seen this before and might be able to help.

I'm fairly new to SPLUNK and I am attempting to send to the indexer a monitored file. This log file overwrites itself throughout the day at random periods based upon the software that generates it. I need to be able to have the file read and the contents pushed to the indexer. I need to make sure that we do not get duplicate values nor miss data from within the file.

We are utilizing SPLUNK 6.1 and the Windows Universal Forwarder to monitor the file. Any insight on the best practice for this scenario would be greatly appreciated.

Thanks.

0 Karma

woodcock
Esteemed Legend

A standard file monitor-based inputs.conf entry should work just fine. It may give you some warm fuzzies to use a batch-based entry to have Splunk delete the file once it is forwarded if it comes in all at once (e.g. FTP) .

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...