https://community.splunk.com/t5/Getting-Data-In/MonitorNoHandle-and-Indexed-Extractions/m-p/507775#M86417 <P>Hi All,</P><P>We been having issues with a CSV that is open for a long period of time while a script writes to it no my idea, but I can get the System Admins to budge.&nbsp;</P><P>I was using a normal monitor and props to do Field Extractions at index time.&nbsp;</P><P>I moved to MonitorNoHandle and it doesn't seem to do field extractions at index time, is this a known thing?&nbsp;</P><P>I know I can fix it by doing a Search time field extraction which I am prob going to do, but I can't see it documented anywhere that this is a known thing.&nbsp;</P><P>Cheers</P><P>&nbsp;</P> Tue, 07 Jul 2020 08:10:16 GMT lukessi 2020-07-07T08:10:16Z https://community.splunk.com/t5/Getting-Data-In/MonitorNoHandle-and-Indexed-Extractions/m-p/507775#M86417 <P>Hi All,</P><P>We been having issues with a CSV that is open for a long period of time while a script writes to it no my idea, but I can get the System Admins to budge.&nbsp;</P><P>I was using a normal monitor and props to do Field Extractions at index time.&nbsp;</P><P>I moved to MonitorNoHandle and it doesn't seem to do field extractions at index time, is this a known thing?&nbsp;</P><P>I know I can fix it by doing a Search time field extraction which I am prob going to do, but I can't see it documented anywhere that this is a known thing.&nbsp;</P><P>Cheers</P><P>&nbsp;</P> Tue, 07 Jul 2020 08:10:16 GMT https://community.splunk.com/t5/Getting-Data-In/MonitorNoHandle-and-Indexed-Extractions/m-p/507775#M86417 lukessi 2020-07-07T08:10:16Z