topic How indexing periodically the same already indexed logfiles with the same content again? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-indexing-periodically-the-same-already-indexed-logfiles-with/m-p/149071#M30360 <P>How can i indexing every day the same already indexed logfiles with the same content again?<BR /> Only the timestamp for the file changes but the content and the filename remains the same.<BR /> We use the Splunk entreprise 6.1.<BR /> Thank you for the help!<BR /> Regards</P> Thu, 13 Feb 2014 08:57:32 GMT hadjaliy 2014-02-13T08:57:32Z How indexing periodically the same already indexed logfiles with the same content again? https://community.splunk.com/t5/Getting-Data-In/How-indexing-periodically-the-same-already-indexed-logfiles-with/m-p/149071#M30360 <P>How can i indexing every day the same already indexed logfiles with the same content again?<BR /> Only the timestamp for the file changes but the content and the filename remains the same.<BR /> We use the Splunk entreprise 6.1.<BR /> Thank you for the help!<BR /> Regards</P> Thu, 13 Feb 2014 08:57:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-indexing-periodically-the-same-already-indexed-logfiles-with/m-p/149071#M30360 hadjaliy 2014-02-13T08:57:32Z Re: How indexing periodically the same already indexed logfiles with the same content again? https://community.splunk.com/t5/Getting-Data-In/How-indexing-periodically-the-same-already-indexed-logfiles-with/m-p/149072#M30361 <P>You just need to add a props.conf in your UF with configuration:</P> <PRE><CODE>[yoursourcetype] CHECK_METHOD = modtime </CODE></PRE> <P>Regards</P> Thu, 13 Feb 2014 09:23:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-indexing-periodically-the-same-already-indexed-logfiles-with/m-p/149072#M30361 gfuente 2014-02-13T09:23:17Z Re: How indexing periodically the same already indexed logfiles with the same content again? https://community.splunk.com/t5/Getting-Data-In/How-indexing-periodically-the-same-already-indexed-logfiles-with/m-p/149073#M30362 <P>many thanks for the fast answer. Your suggestion was super.<BR /> Only:<BR /> * Important: this option is only valid for [source::<SOURCE>] stanzas.</SOURCE></P> <P>Thank you for your help!!<BR /> Best regards.</P> Thu, 13 Feb 2014 10:19:27 GMT https://community.splunk.com/t5/Getting-Data-In/How-indexing-periodically-the-same-already-indexed-logfiles-with/m-p/149073#M30362 hadjaliy 2014-02-13T10:19:27Z