Monitoring Splunk

Add moitor changes are not reflecting to my search

prathapkcsc
Explorer

I have some data with 4 lines in my.txt file. I uploaded this file into splunk, Successfully getting this data as a event.
This is my search source="my.txt" sourcetype="my1_monitor"
After i added this file to monitor clause in input.conf.
My input.conf`
[monitor: //C:\Users\Users\Desktop\my.txt]
sourcetype=my1_monitor

After this, 3 more lines of data added to that file and i restarted the splunkd.exe service.
But, Still changes are not reflecting my search, First 4 lines of data was showing.
Any solution for this problem.

Thank you

0 Karma

lavanyaanne
Path Finder

Try to use the followTail option because it reads data that arrives after the first encounter.
In inputs.conf Add
followTail=1

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...