Getting Data In

Re-indexing the complete file

NAVEEN_CTS
Path Finder

I have a file that is monitored at the UF . File gets frequently updated (same file). In some occasion , already existing fields might change and in some occasion additional lines will be added either at the bottom , or at any part of the file.

Problem here is, if changes occurring at the beginning or in first few lines....the complete file gets indexed, whereas if the changes occurring at the bottom . (for ex : if 2 additional lines added at bottom) only those 2 lines are indexed.

Requirement:

In whatever the case , if there are changes in the file , i want the file to be completely re-indexed. If this is possible please help me with the steps.

Thanks in Advance

0 Karma

koshyk
Super Champion

The idea is to index the whole file everytime, then the following thread might help you.
https://answers.splunk.com/answers/5426/entire-file-contents-as-a-single-event.html

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...