How to use CHECK_METHOD in Univsersal Forwarder

[sieutruc]

Hello all,

I have a big csv file. Sometimes the file is updated in the middle of the file, so the current CRC checking that Splunk uses is not working. So in order to make sure the file be indexed , i want to monitor the change of file by checking its entire MD5. But the problem is we cannot place props on Universal Forwarder.

SO what should i do ?

Another small question is CHECK_METHOD=modtime . What does modtime mean ? Doest the file be indexed when its date modification is changed, no mattter its content is changed or not ?

[alanden_splunk]

CHECK_METHOD=entire_md5 goes into props on UF. The limitation is that some props options do not work on the UF, but this option does work on the UF.

https://answers.splunk.com/answers/104592/ingesting-file-data.html

[gkanapathy]

You can put props.conf on the forwarder. CHECK_METHOD would be pretty useless if it didn't work where the input files were located. However, this may not work for you regardless. If you are updating file in the middle, the only way to capture the change is to index the entire file. If that's what you want, then that's fine, but if you're hoping that you can just capture the lines that get modified, Splunk doesn't work that way. Yes, modtime looks at the modification time of the file to decide if it's been changed.

[sieutruc]

I tried CHECK_METHOD=modtime but it didn't work. Have you tested it before ?