Getting Data In

MonitorNoHandle and Indexed_Extractions

lukessi
Path Finder

Hi All,

We been having issues with a CSV that is open for a long period of time while a script writes to it no my idea, but I can get the System Admins to budge. 

I was using a normal monitor and props to do Field Extractions at index time. 

I moved to MonitorNoHandle and it doesn't seem to do field extractions at index time, is this a known thing? 

I know I can fix it by doing a Search time field extraction which I am prob going to do, but I can't see it documented anywhere that this is a known thing. 

Cheers

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...