Getting Data In

why Splunk is not able to index all the data from a txt file?

niks987
Explorer

Hi All,

Hope you all are doing good.

I am trying to read two simple txt files containing just the numeric value . These files get updated twice every day, morning and evening. I have used same props.conf for both the files. 

Splunk is able to read the first txt file properly in the morning and evening, but when it comes to 2nd txt file if their is same type of data present in the morning  than splunk ignores that data in the evening.

Example. If in morning in 2nd txt file the value is 1 and in evening the value is 15 than splunk only reads 5 in the evening file.

[monitor://C:\test.txt]
sourcetype = test
ignoreOlderThan = 60d
disabled = false
crcSalt = <SOURCE>

[test]
DATETIME_CONFIG=CURRENT
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)
TRUNCATE=100

Labels (2)
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...