Solved: How can I watch a CSV file?

daniel333 · ‎09-13-2018

All,

I have a CSV being laid to a file system by a database.

A basic monitor stanza brought the file in perfect with sourctype=csv. However, when a new file is loaded with the same name, Splunk does not bring in the file with the new contents. Any idea on how to get Splunk to reread the file?

daniel333 · ‎09-13-2018

Not sure why but a forwarder restart solved this. Just worked.

View solution in original post

daniel333 · ‎09-13-2018

Not sure why but a forwarder restart solved this. Just worked.

How can I watch a CSV file?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Join the Final Session of the Data Management & Federation Bootcamp Series

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Join the Conversation