Solved: Re: How can I watch a CSV file?

daniel333 · ‎09-13-2018

All,

I have a CSV being laid to a file system by a database.

A basic monitor stanza brought the file in perfect with sourctype=csv. However, when a new file is loaded with the same name, Splunk does not bring in the file with the new contents. Any idea on how to get Splunk to reread the file?

daniel333 · ‎09-13-2018

Not sure why but a forwarder restart solved this. Just worked.

View solution in original post

daniel333 · ‎09-13-2018

Not sure why but a forwarder restart solved this. Just worked.

How can I watch a CSV file?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Join the Conversation