Getting Data In

Re-index all lines of a CSV file after any change?

Path Finder

I have CSV files that are point-in-time snapshots of a configuration. If any part of the CSV changes, I'd like the contents of the entire CSV file to be re-indexed and not just the lines that changed. I hope to reference each "version" of the CSV's contents in Splunk by the index time.

I've tried playing with the different options for the CHECK_METHOD option for props.conf, but it continues to only index the lines that have changed rather than the entire file.


index = tracking
sourcetype = baselines


0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!