I've got an extremely frustrating problem here, at my wit's end and finally coming here.
I've got CSV files being generated by Powershell every 15 minutes. Splunk is set to look at the directory and pull in the CSV files' data. It pulls it in ONCE, and then does not pull the data in again until after Splunk is restarted. What on earth is going on here?
The CSV files look like this, for example:
2016-09-22-13-56-sfbClientConnections.csv
First few lines of the CSV look like this:
"Time","Username","ClientVersion","Fqdn"
"2016-09-22-13:56","[email protected]","UCCAPI/15.0.4849.1000 OC/15.0.4849.1000 (Skype for Business)","server1"
"2016-09-22-13:56","[email protected]","UCCAPI/15.0.4849.1000 OC/15.0.4849.1000 (Skype for Business)","server2"
inputs.conf looks like this...I've tried with and without the crcSalt:
[monitor://C:\Scripts\SkypeForBusinessClientConnections\logs\*csv]
disabled = false
host = mailmon2
index = sfb
sourcetype = HydroMessaging:SFB:ClientConnections
crcSalt = <SOURCE>
props.conf looks like this:
[HydroMessaging:SFB:ClientConnections]
NO_BINARY_CHECK = 1
pulldown_type = 1
HEADER_MODE = firstline
FIELD_DELIMITER=,
FIELD_QUOTE="
TIME_FORMAT=%Y-%m-%d-%H:%M
TIMESTAMP_FIELDS=Time
