Re-indexing the complete file

NAVEEN_CTS — Mon, 27 May 2019 20:04:07 GMT

I have a file that is monitored at the UF . File gets frequently updated (same file). In some occasion , already existing fields might change and in some occasion additional lines will be added either at the bottom , or at any part of the file.

Problem here is, if changes occurring at the beginning or in first few lines....the complete file gets indexed, whereas if the changes occurring at the bottom . (for ex : if 2 additional lines added at bottom) only those 2 lines are indexed.

Requirement:

In whatever the case , if there are changes in the file , i want the file to be completely re-indexed. If this is possible please help me with the steps.

Thanks in Advance

Re: Re-indexing the complete file

koshyk — Mon, 27 May 2019 21:09:09 GMT

The idea is to index the whole file everytime, then the following thread might help you.
https://answers.splunk.com/answers/5426/entire-file-contents-as-a-single-event.html

topic Re-indexing the complete file in Getting Data In

Re-indexing the complete file

Re: Re-indexing the complete file