Getting Data In

What is the best way to use a universal forwarder to monitor a file that overwrites itself at random periods throughout the day?

rfoley
New Member

Hoping that someone has seen this before and might be able to help.

I'm fairly new to SPLUNK and I am attempting to send to the indexer a monitored file. This log file overwrites itself throughout the day at random periods based upon the software that generates it. I need to be able to have the file read and the contents pushed to the indexer. I need to make sure that we do not get duplicate values nor miss data from within the file.

We are utilizing SPLUNK 6.1 and the Windows Universal Forwarder to monitor the file. Any insight on the best practice for this scenario would be greatly appreciated.

Thanks.

0 Karma

woodcock
Esteemed Legend

A standard file monitor-based inputs.conf entry should work just fine. It may give you some warm fuzzies to use a batch-based entry to have Splunk delete the file once it is forwarded if it comes in all at once (e.g. FTP) .

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...