https://community.splunk.com/t5/Getting-Data-In/How-to-ingest-same-events-daily/m-p/435580#M76007 <P>The easiest way to do this is to setup a <CODE>cron</CODE> job on your Forwarder and use <CODE>add oneshot</CODE>:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorfilesanddirectoriesusingtheCLI">https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorfilesanddirectoriesusingtheCLI</A><BR /> This ensures that you ALWAYS bypass the fishbucket and send in the entire file.</P> Sat, 22 Jun 2019 01:51:22 GMT woodcock 2019-06-22T01:51:22Z https://community.splunk.com/t5/Getting-Data-In/How-to-ingest-same-events-daily/m-p/435579#M76006 <P>I have a file and I want it to ingest daily. What are the proper inputs and props should I used?</P> <P>I tried setting <CODE>CHECK_METHOD = mod_time on props and TIME_BEFORE_CLOSE = 86400</CODE><BR /> but it just ingests all new events.</P> Thu, 20 Jun 2019 09:13:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-ingest-same-events-daily/m-p/435579#M76006 japposadas 2019-06-20T09:13:52Z https://community.splunk.com/t5/Getting-Data-In/How-to-ingest-same-events-daily/m-p/435580#M76007 <P>The easiest way to do this is to setup a <CODE>cron</CODE> job on your Forwarder and use <CODE>add oneshot</CODE>:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorfilesanddirectoriesusingtheCLI">https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorfilesanddirectoriesusingtheCLI</A><BR /> This ensures that you ALWAYS bypass the fishbucket and send in the entire file.</P> Sat, 22 Jun 2019 01:51:22 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-ingest-same-events-daily/m-p/435580#M76007 woodcock 2019-06-22T01:51:22Z