Hi there,
I am trying to monitor a file that doesn't change often - WebSphere nodeagent monitor.state file. I understand that the best and easiest option would be to use scripted input. However, the use of scripted input is not permitted on the client site. Can anyone please advise if there is another way to re-index a file that hasn't changed let's say once a week?
The solution that my colleague and I found at the end was to use scheduled search that runs on specified interval and outputs the results into a csv file. I can then use the csv file to create the necessary searches and build dashboard panels. This means that the results will not drop off the index, the retention policy doesn't need to be very long and the searches that are using the output from the lookup table doesn't need to be in a long time range. I guess the best solution in this use case is to use the scheduled search that writes to a lookup table. Although I agree that scripted input would have been the best solution if it would have been permitted. This is an isolated use case based on a particular organisational policies.
If your results are in a CSV, and you're using a scheduled search to get the results into the CSV, you don't need to monitor the CSV at all. You can just use | inputlookup <csv>
every time you run a search instead.
This is definitely a non-standard use case. As @adonio mentioned, it may be worth reconsidering the value in indexing a file with no changes at an interval basis.
That said, would you be allowed to use a modular input with this client? It is technically a script, but so it a good portion of Splunk itself.
Let me understand the question correctly,why cant you schedule interval in inputs.conf?
you can on a scripted input...
create a script that will read your file and index it again
I am not allowed to use scripted input. Against company's policy
can you install Universal Forwarder on the system where that static file exists?
Hi. Thank you for responding so promptly. The Universal Forwarder is installed on the server that contains this file in /opt directory . I have indexed the file. However, the issue is that this file may not change for a long time and splunk is monitoring the files for changes. What I am trying to achieve is to index the same file as per interval basis, which may be not possible.
if the file does not change, what is the use case of indexing it on an interval basis?