automatic update row in a index file

tissparkle — Wed, 26 Jun 2013 10:31:01 GMT

Hi, I put a file in a specific directory to be indexed.
This file is update in a automatic way in a directory.

My issue is:
The index file makes a sum of the old file and the new file events and this is not correct for my use. for example: 1° file is 200 events - after that the second time file is 200+10 new events.
I would like to have a result of the index like 210 events not 410 events. I would like to understand if there is a different way to delete the old index and make everything automatic. thanks a lots

Re: automatic update row in a index file

martin_mueller — Wed, 26 Jun 2013 11:37:04 GMT

Splunk always appends new data to the existing old data. Your case sounds like a lookup rather than indexed data, take a look at http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutlookupsandfieldactions for more info.

topic automatic update row in a index file in Getting Data In

automatic update row in a index file

Re: automatic update row in a index file