topic Re: Configure inputs.conf to reindex file every time modification time changes? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Configure-inputs-conf-to-reindex-file-every-time-modification/m-p/271456#M52125 <P>Thanks! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /> But the docs you are refering to are very old and not relevant anymore</P> Fri, 09 Sep 2016 13:30:27 GMT horsefez 2016-09-09T13:30:27Z Configure inputs.conf to reindex file every time modification time changes? https://community.splunk.com/t5/Getting-Data-In/Configure-inputs-conf-to-reindex-file-every-time-modification/m-p/271454#M52123 <P>Hi fellow splunkers, </P> <P>I want to know if I can somehow define a monitor-stanza that reindexes a file (entirely reindexes) each and everytime if the modification time is changed.<BR /> So far I found the parameters crcSalt and initCrcLength, but not sure how to use them correctly.</P> <P>Has anyone an idea how to configure this the right way?</P> <P>Thanks for your help!</P> <P>Best regards, <BR /> pyro_wood</P> Fri, 09 Sep 2016 12:35:48 GMT https://community.splunk.com/t5/Getting-Data-In/Configure-inputs-conf-to-reindex-file-every-time-modification/m-p/271454#M52123 horsefez 2016-09-09T12:35:48Z Re: Configure inputs.conf to reindex file every time modification time changes? https://community.splunk.com/t5/Getting-Data-In/Configure-inputs-conf-to-reindex-file-every-time-modification/m-p/271455#M52124 <P>Hi pyro_wood,</P> <P>i hope this answer will help you. You can set the check_method in props.conf source stanza, to achieve your solution.</P> <P><A href="https://answers.splunk.com/answers/61006/file-system-monitoring-of-text-files-that-are-overwritten.html">https://answers.splunk.com/answers/61006/file-system-monitoring-of-text-files-that-are-overwritten.html</A></P> <P>regards</P> Fri, 09 Sep 2016 13:28:55 GMT https://community.splunk.com/t5/Getting-Data-In/Configure-inputs-conf-to-reindex-file-every-time-modification/m-p/271455#M52124 TStrauch 2016-09-09T13:28:55Z Re: Configure inputs.conf to reindex file every time modification time changes? https://community.splunk.com/t5/Getting-Data-In/Configure-inputs-conf-to-reindex-file-every-time-modification/m-p/271456#M52125 <P>Thanks! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /> But the docs you are refering to are very old and not relevant anymore</P> Fri, 09 Sep 2016 13:30:27 GMT https://community.splunk.com/t5/Getting-Data-In/Configure-inputs-conf-to-reindex-file-every-time-modification/m-p/271456#M52125 horsefez 2016-09-09T13:30:27Z Re: Configure inputs.conf to reindex file every time modification time changes? https://community.splunk.com/t5/Getting-Data-In/Configure-inputs-conf-to-reindex-file-every-time-modification/m-p/271457#M52126 <P>Hi, the props.conf link refers to the latest version of props.conf <span class="lia-unicode-emoji" title=":winking_face:">😉</span> and the postet link props.conf and inputs.conf do the same <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Fri, 09 Sep 2016 13:45:37 GMT https://community.splunk.com/t5/Getting-Data-In/Configure-inputs-conf-to-reindex-file-every-time-modification/m-p/271457#M52126 TStrauch 2016-09-09T13:45:37Z Re: Configure inputs.conf to reindex file every time modification time changes? https://community.splunk.com/t5/Getting-Data-In/Configure-inputs-conf-to-reindex-file-every-time-modification/m-p/271458#M52127 <P>How big is the file? </P> Fri, 09 Sep 2016 15:18:22 GMT https://community.splunk.com/t5/Getting-Data-In/Configure-inputs-conf-to-reindex-file-every-time-modification/m-p/271458#M52127 somesoni2 2016-09-09T15:18:22Z Re: Configure inputs.conf to reindex file every time modification time changes? https://community.splunk.com/t5/Getting-Data-In/Configure-inputs-conf-to-reindex-file-every-time-modification/m-p/271459#M52128 <P>A great thread about it at <A href="https://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder.html">How to reindex data from a forwarder</A></P> <P>It says - </P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1819iFE975305EFCC6222/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Sun, 11 Sep 2016 21:26:24 GMT https://community.splunk.com/t5/Getting-Data-In/Configure-inputs-conf-to-reindex-file-every-time-modification/m-p/271459#M52128 ddrillic 2016-09-11T21:26:24Z Re: Configure inputs.conf to reindex file every time modification time changes? https://community.splunk.com/t5/Getting-Data-In/Configure-inputs-conf-to-reindex-file-every-time-modification/m-p/271460#M52129 <P>Hi somesoni2, <BR /> I try indexing the splunk.conf files so someone outside of splunk gets alerted when there is a change to them. <BR /> I don't think those files are big if it boils down to size.</P> Tue, 13 Sep 2016 15:47:22 GMT https://community.splunk.com/t5/Getting-Data-In/Configure-inputs-conf-to-reindex-file-every-time-modification/m-p/271460#M52129 horsefez 2016-09-13T15:47:22Z Re: Configure inputs.conf to reindex file every time modification time changes? https://community.splunk.com/t5/Getting-Data-In/Configure-inputs-conf-to-reindex-file-every-time-modification/m-p/271461#M52130 <P>Cool, thanks ddrillic! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 13 Sep 2016 15:51:29 GMT https://community.splunk.com/t5/Getting-Data-In/Configure-inputs-conf-to-reindex-file-every-time-modification/m-p/271461#M52130 horsefez 2016-09-13T15:51:29Z