The test_new.html is getting update every 4 hours.The html file may or maynot have same number of lines.
The data is only coming immediately when I am adding say test data into the html file. That means the data flow is not an issue.
I am expecting it to send me data as and when timestamp of the file changes.
Need your suggestions on the same.
I have done below configuration
In UF agent I have added inputs.conf as
[monitor:///root/splunkstorage/test_new.html]
disabled = false
index = test_normal
sourcetype = test:global:testnew:html
crcSalt = <SOURCE>
In the indexer I have props.conf
[test:global:testnew:html]
DATETIME_CONFIG = CURRENT
CHECK_METHOD = modtime
LINE_BREAKER = (<html><body>)
NO_BINARY_CHECK = true
SEDCMD-addvalues = s/<head>/<html><body>\n<head>/g
TRUNCATE = 0
category = Custom
disabled = false
pulldown_type = true
