Getting Data In

Re-index all lines of a CSV file after any change?

jamesklassen
Path Finder

I have CSV files that are point-in-time snapshots of a configuration. If any part of the CSV changes, I'd like the contents of the entire CSV file to be re-indexed and not just the lines that changed. I hope to reference each "version" of the CSV's contents in Splunk by the index time.

I've tried playing with the different options for the CHECK_METHOD option for props.conf, but it continues to only index the lines that have changed rather than the entire file.

inputs.conf:

[monitor://C:\baselines\BaselinePorts.csv]
index = tracking
sourcetype = baselines

props.conf

[baselines]
FIELD_DELIMITER=,
HEADER_FIELD_DELIMITER=,
CHECK_METHOD=endpoint_md5
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...