https://community.splunk.com/t5/Getting-Data-In/Why-is-Powershell-generated-CSV-data-that-is-monitored-only/m-p/206827#M40819 <P>Try a monitorNoHandle stanza instead of just monitor. (<A href="http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Monitorfilesanddirectories">http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Monitorfilesanddirectories</A>)</P> Fri, 23 Sep 2016 13:56:43 GMT lycollicott 2016-09-23T13:56:43Z https://community.splunk.com/t5/Getting-Data-In/Why-is-Powershell-generated-CSV-data-that-is-monitored-only/m-p/206826#M40818 <P>I've got an extremely frustrating problem here, at my wit's end and finally coming here.</P> <P>I've got CSV files being generated by Powershell every 15 minutes. Splunk is set to look at the directory and pull in the CSV files' data. It pulls it in ONCE, and then does not pull the data in again until after Splunk is restarted. What on earth is going on here?</P> <P>The CSV files look like this, for example: </P> <P><CODE>2016-09-22-13-56-sfbClientConnections.csv</CODE></P> <P>First few lines of the CSV look like this:</P> <PRE><CODE>"Time","Username","ClientVersion","Fqdn" "2016-09-22-13:56","user1@domain.com","UCCAPI/15.0.4849.1000 OC/15.0.4849.1000 (Skype for Business)","server1" "2016-09-22-13:56","user2@domain.com","UCCAPI/15.0.4849.1000 OC/15.0.4849.1000 (Skype for Business)","server2" </CODE></PRE> <P>inputs.conf looks like this...I've tried with and without the crcSalt:</P> <PRE><CODE>[monitor://C:\Scripts\SkypeForBusinessClientConnections\logs\*csv] disabled = false host = mailmon2 index = sfb sourcetype = HydroMessaging:SFB:ClientConnections crcSalt = &lt;SOURCE&gt; </CODE></PRE> <P>props.conf looks like this:</P> <PRE><CODE>[HydroMessaging:SFB:ClientConnections] NO_BINARY_CHECK = 1 pulldown_type = 1 HEADER_MODE = firstline FIELD_DELIMITER=, FIELD_QUOTE=" TIME_FORMAT=%Y-%m-%d-%H:%M TIMESTAMP_FIELDS=Time </CODE></PRE> Thu, 22 Sep 2016 19:05:09 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-Powershell-generated-CSV-data-that-is-monitored-only/m-p/206826#M40818 jamesklassen 2016-09-22T19:05:09Z https://community.splunk.com/t5/Getting-Data-In/Why-is-Powershell-generated-CSV-data-that-is-monitored-only/m-p/206827#M40819 <P>Try a monitorNoHandle stanza instead of just monitor. (<A href="http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Monitorfilesanddirectories">http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Monitorfilesanddirectories</A>)</P> Fri, 23 Sep 2016 13:56:43 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-Powershell-generated-CSV-data-that-is-monitored-only/m-p/206827#M40819 lycollicott 2016-09-23T13:56:43Z