Upload File vs. Index-once Monitor File

[morethanyell]

Would like to get some enlightenment on what's the difference between the two. TIA

[kmorris_splunk · Accepted solution]

Upload would be for data that is on your local machine, while the monitor / index once option would be if the data is local to Splunk.

[morethanyell]

I understand tho that once I upload, say for example a CSV file, using Add Data > Upload OR Add Data > Monitor > Files & Directories > Index Once they're both written on the disk where Splunk deployed (as long as I use the same index). Is that right?