Getting Data In

automatic update row in a index file

tissparkle
Explorer

Hi, I put a file in a specific directory to be indexed.
This file is update in a automatic way in a directory.

My issue is:
The index file makes a sum of the old file and the new file events and this is not correct for my use. for example: 1° file is 200 events - after that the second time file is 200+10 new events.
I would like to have a result of the index like 210 events not 410 events. I would like to understand if there is a different way to delete the old index and make everything automatic. thanks a lots

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Splunk always appends new data to the existing old data. Your case sounds like a lookup rather than indexed data, take a look at http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutlookupsandfieldactions for more info.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...