https://community.splunk.com/t5/Getting-Data-In/Index-only-new-lines/m-p/411045#M94522 <P>Hi.</P> <P>I have a requirement of a client, he has a file that indexes every day, but that file is modified at different times, for example modifications to lines 8 and 10000 at 20:00hrs, after modifications of lines 2 and 10100 at 22:00 hrs , Is it possible to index only the lines that have been modified?, at 2:00 am the file not change more.</P> Wed, 27 Jun 2018 13:23:06 GMT grivera_kudaw 2018-06-27T13:23:06Z https://community.splunk.com/t5/Getting-Data-In/Index-only-new-lines/m-p/411045#M94522 <P>Hi.</P> <P>I have a requirement of a client, he has a file that indexes every day, but that file is modified at different times, for example modifications to lines 8 and 10000 at 20:00hrs, after modifications of lines 2 and 10100 at 22:00 hrs , Is it possible to index only the lines that have been modified?, at 2:00 am the file not change more.</P> Wed, 27 Jun 2018 13:23:06 GMT https://community.splunk.com/t5/Getting-Data-In/Index-only-new-lines/m-p/411045#M94522 grivera_kudaw 2018-06-27T13:23:06Z https://community.splunk.com/t5/Getting-Data-In/Index-only-new-lines/m-p/411046#M94523 <P>No, Splunk cannot be configured to monitor individual changes inside a file. Just the entire file, or new lines at the end of a file.</P> <P>So the only way to do this would be to write some kind of script that detects the changes and writes those to a new file that is monitored by Splunk.</P> Wed, 27 Jun 2018 15:44:44 GMT https://community.splunk.com/t5/Getting-Data-In/Index-only-new-lines/m-p/411046#M94523 FrankVl 2018-06-27T15:44:44Z