- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Monitoring Static file
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Monitoring Static file
Hi there,
I am trying to monitor a file that doesn't change often - WebSphere nodeagent monitor.state file. I understand that the best and easiest option would be to use scripted input. However, the use of scripted input is not permitted on the client site. Can anyone please advise if there is another way to re-index a file that hasn't changed let's say once a week?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The solution that my colleague and I found at the end was to use scheduled search that runs on specified interval and outputs the results into a csv file. I can then use the csv file to create the necessary searches and build dashboard panels. This means that the results will not drop off the index, the retention policy doesn't need to be very long and the searches that are using the output from the lookup table doesn't need to be in a long time range. I guess the best solution in this use case is to use the scheduled search that writes to a lookup table. Although I agree that scripted input would have been the best solution if it would have been permitted. This is an isolated use case based on a particular organisational policies.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If your results are in a CSV, and you're using a scheduled search to get the results into the CSV, you don't need to monitor the CSV at all. You can just use | inputlookup <csv> every time you run a search instead.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is definitely a non-standard use case. As @adonio mentioned, it may be worth reconsidering the value in indexing a file with no changes at an interval basis.
That said, would you be allowed to use a modular input with this client? It is technically a script, but so it a good portion of Splunk itself.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Let me understand the question correctly,why cant you schedule interval in inputs.conf?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you can on a scripted input...
create a script that will read your file and index it again
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am not allowed to use scripted input. Against company's policy
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
can you install Universal Forwarder on the system where that static file exists?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi. Thank you for responding so promptly. The Universal Forwarder is installed on the server that contains this file in /opt directory . I have indexed the file. However, the issue is that this file may not change for a long time and splunk is monitoring the files for changes. What I am trying to achieve is to index the same file as per interval basis, which may be not possible.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
if the file does not change, what is the use case of indexing it on an interval basis?
Adoption of RUM and APM at Splunk
Routing logs with Splunk OTel Collector for Kubernetes
Welcome to the Splunk Community!
