Getting Data In

how to monitor file change in a delta mode?

gavintofly
New Member

I am going to monitor file change on several servers,but I don't like the way of sharing directory .so I installed a sync software on these servers. When there is a file change,The change file was sync to a server for central management.And i use splunk to monitor the single server.After some time, i found that the index volume was overhead:the files was about 50M in total,but the index volume is 5G in a day. the files name did not change during the sync process.but everytime the sync process delete the oldfile and create a new file with the same name? Is this the reason of index overhead?

Tags (1)
0 Karma

treinke
Builder

Are you using Montior or FSChange? If you are using Monitor than Splunk is grabbing the content of the file and indexing it. If the file changes, it grabs the new data. If you are using FSChange, then every time the file changes a new md5 is created and Splunk will log that.

There are no answer without questions
0 Karma

treinke
Builder

Can you post you monitor stanza?

There are no answer without questions
0 Karma

gavintofly
New Member

I am using Monitor but everytime the content of files change,splunk grabs the whole file again.so the index volume run out quickly.how splunk identifies a file as a new file? the files monitored hold their name unchanged but everytime the files change,the file was deleted and created again.Is this the cause of problem?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...