Getting Data In

Data ingestion

krish5vuda
Engager

Hi all. I am ingesting a CSV file from a UF where the CSV is daily updated by the app team at a particular time and  I have seen data in splunk ingesting on hourly basis which should not be the case and it should be ingesting only once per day need suggestions on how to eliminate this and make sure the data is ingesting only once per day

 

  •  

 

 

Labels (1)
0 Karma

Gr0und_Z3r0
Contributor

I believe you will have to update your inputs.conf and write a scripted input configuration to run the job on scheduled time. 
https://docs.splunk.com/Documentation/Splunk/8.2.3/Admin/Inputsconf 

Also the current behavior you mentioned might be due to the enablement of the crcSalt in the inputs.conf that looks for hash change of the file state and if it happens, indexes the new data.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...