Getting Data In

What is the best way to use a universal forwarder to monitor a file that overwrites itself at random periods throughout the day?

rfoley
New Member

Hoping that someone has seen this before and might be able to help.

I'm fairly new to SPLUNK and I am attempting to send to the indexer a monitored file. This log file overwrites itself throughout the day at random periods based upon the software that generates it. I need to be able to have the file read and the contents pushed to the indexer. I need to make sure that we do not get duplicate values nor miss data from within the file.

We are utilizing SPLUNK 6.1 and the Windows Universal Forwarder to monitor the file. Any insight on the best practice for this scenario would be greatly appreciated.

Thanks.

0 Karma

woodcock
Esteemed Legend

A standard file monitor-based inputs.conf entry should work just fine. It may give you some warm fuzzies to use a batch-based entry to have Splunk delete the file once it is forwarded if it comes in all at once (e.g. FTP) .

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...