Monitoring Splunk

How to re-read the same file again daily

mlevsh
Builder

Hi,
trying to find the best solution (approach) to the following issue:

We are monitoring ( via Splunk Universal forwarder ) the file "Assignment_group.csv" , exported daily from Service Now.
It exports assignment_groups and It has department name, team name, team's manager:
"Our department" , "Our Team", "Our Manager".
We ingest it and use it as lookup for assignment groups in our related dashboards.

If file is not changed - Splunk doesn't index it again , it seems, and as a result - our lookup gets empty.

We thought about using [batch://...] to read the same file instead of [monitor://...] but it deletes the source file and we want to keep it for troubleshooting proposes.

Any advice will be appreciated

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mlevsh,
you have to read the lookup values and use them before overriding the lookup itself, in other words, something like this:

index=my_index
| append [ | inputlookup my_lookup | table field1 field2 field3 ]
| stats values(field2) AS field2 values(field3) AS field3 BY field1
| eval field2=mvindex(field2,0), field3=mvindex(field3,0)
| table field1 field2 field3
| outputlookup my_lookup

where field1 is the key field and field2 and field3 are the fields to upgrade.

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...