Im my case , i want a file to be completely reindex irrespective of the changes made at the first, middle or at the bottom of the file.
When changes are made at bottom of the file , like adding 2 lines at the bottom , i want splunk to consider it as a new file and reindex the the complete file instead of adding only 2 lines to the index
Here the file name will not be changed, only data inside the file will be updated.
I have tried crcSalt = < SOURCE> in my inputs.conf , but it didnt work
is there any way to make splunk to reindex the file again?
Hi @alemarzu , Still it didn't work
My config is as below, only new changes are getting indexed , entire file is not getting re-indexed again
index = test
sourcetype = test
CHECK_METHOD = entire_md5