Hi fellow splunkers,
I want to know if I can somehow define a monitor-stanza that reindexes a file (entirely reindexes) each and everytime if the modification time is changed.
So far I found the parameters crcSalt and initCrcLength, but not sure how to use them correctly.
Has anyone an idea how to configure this the right way?
Thanks for your help!
I try indexing the splunk.conf files so someone outside of splunk gets alerted when there is a change to them.
I don't think those files are big if it boils down to size.
i hope this answer will help you. You can set the check_method in props.conf source stanza, to achieve your solution.