Solved: How can I watch a CSV file?

daniel333 · ‎09-13-2018

All,

I have a CSV being laid to a file system by a database.

A basic monitor stanza brought the file in perfect with sourctype=csv. However, when a new file is loaded with the same name, Splunk does not bring in the file with the new contents. Any idea on how to get Splunk to reread the file?

daniel333 · ‎09-13-2018

Not sure why but a forwarder restart solved this. Just worked.

View solution in original post

daniel333 · ‎09-13-2018

Not sure why but a forwarder restart solved this. Just worked.

How can I watch a CSV file?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Join the Conversation