I have set up batch files to count the number of documents in a folder. Splunk is running this batch file successfully every 60 seconds (this is working since I see it from the timestamp of the text files).
I have set it up as follows in my app's inputs.conf:
When I check my index/ sourcetype, I can see that the data is not coming in continuously (sometimes it is coming in, sometimes not). Since I have configured my panel to refresh every 60 seconds and only check for the value of the last 60 seconds, my panels sometimes do not show any data.
I have some log entries in my splunkd.log
06-30-2016 08:59:59.278 +0200 INFO WatchedFile - Checksum for seekptr didn't match, will re-read entire file='D:\OT System Monitoring\counteSignToLES.txt'.
06-30-2016 08:59:59.278 +0200 INFO WatchedFile - Will begin reading at offset=0 for file='D:\OT System Monitoring\counteSignToLES.txt'.
I guess that Splunk thinks that there is no change in the file (since sometimes the count is 0 for some time or the same value for some time).
Is there a way to fix this? I have already tried followTail and initCrCLength (see above).