topic Re: When indexing historic and real time data together, does Splunk index old data first and new data last or vice versa? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/When-indexing-historic-and-real-time-data-together-does-Splunk/m-p/207282#M40887 <P>When indexing a file, it indexes line by line, starting with the beginning, and ending with the end of file.</P> Wed, 02 Nov 2016 20:05:35 GMT bshuler_splunk 2016-11-02T20:05:35Z When indexing historic and real time data together, does Splunk index old data first and new data last or vice versa? https://community.splunk.com/t5/Getting-Data-In/When-indexing-historic-and-real-time-data-together-does-Splunk/m-p/207281#M40886 <P>I have to index the historic data along with real time data from the log file. May I know from which point the indexing starts; whether it starts ingesting old data first and latest data at the end, or vice versa? . </P> Wed, 02 Nov 2016 16:40:05 GMT https://community.splunk.com/t5/Getting-Data-In/When-indexing-historic-and-real-time-data-together-does-Splunk/m-p/207281#M40886 ankithreddy777 2016-11-02T16:40:05Z Re: When indexing historic and real time data together, does Splunk index old data first and new data last or vice versa? https://community.splunk.com/t5/Getting-Data-In/When-indexing-historic-and-real-time-data-together-does-Splunk/m-p/207282#M40887 <P>When indexing a file, it indexes line by line, starting with the beginning, and ending with the end of file.</P> Wed, 02 Nov 2016 20:05:35 GMT https://community.splunk.com/t5/Getting-Data-In/When-indexing-historic-and-real-time-data-together-does-Splunk/m-p/207282#M40887 bshuler_splunk 2016-11-02T20:05:35Z Re: When indexing historic and real time data together, does Splunk index old data first and new data last or vice versa? https://community.splunk.com/t5/Getting-Data-In/When-indexing-historic-and-real-time-data-together-does-Splunk/m-p/207283#M40888 <P>thank you, Suppose the UF is restarted ,May I know how Splunk remember the line where it got stopped previously to start ingestion from that point. If not will it start ingestion again from the beggining of the file?</P> Wed, 02 Nov 2016 20:37:19 GMT https://community.splunk.com/t5/Getting-Data-In/When-indexing-historic-and-real-time-data-together-does-Splunk/m-p/207283#M40888 ankithreddy777 2016-11-02T20:37:19Z Re: When indexing historic and real time data together, does Splunk index old data first and new data last or vice versa? https://community.splunk.com/t5/Getting-Data-In/When-indexing-historic-and-real-time-data-together-does-Splunk/m-p/207284#M40889 <P>There is a "magic" index called fishbucket. All of the pointers for remembering the last location for files are in it. Splunk does not forget and reindex.</P> Thu, 03 Nov 2016 01:22:26 GMT https://community.splunk.com/t5/Getting-Data-In/When-indexing-historic-and-real-time-data-together-does-Splunk/m-p/207284#M40889 bshuler_splunk 2016-11-03T01:22:26Z