Problem with CRC in SPLUNK

[abhayneilam]

Hi,
I have file which I have imported in splunk :

"First","Second","Last","Phone","Age","Location","Office","Martial_Status"
Abhay,Vikram,Singh,8902470972,26,Kolkata,EDEN,S
Mura,,Bhartia,1111111111,25,Noida,LORDS,S
Shrijata,,Mitradutta,2222222222,29,Kolkata,EDEN,M
Arijeet,Kumar,Panda,3333333333,20,Durb

and my inputs.conf contains :

[monitor://C:\Documents and Settings\313456\Desktop\test_file.txt]
disabled = false
followTail = 0
crcSalt=<SOURCE>
index = Training
sourcetype = train

"Abhay" is apprearing only one time as per the file, but If I edit "Abhay" to "Avay" OR if I append any new row to the file, then that count is getting increased.

Abhay is showing 2 times
Shrijata is showing 2 times..

I want, If I edit any field then that field should come instead of the old name, and the count should be perfect..

Please help me in this regards,

Thanks in advance,
Abhay

[alacercogitatus]

A monitor in the Inputs.conf watches a file for changes, and then indexes the changes. If you want to use a static file for searches where the count is correct, you should use a lookup.

Place your txt file in $SPLUNK_HOME\etc\apps\search\lookups (rename to test_file.csv), and then in your search you can pull it in: |inputlookup test_file.csv.

[abhayneilam]

To delete the old data what I need to do and to work with only the new one

[Ayn]

Splunk is NOT a general purpose database where you can change existing data in the index, or change some data in an input file and have the "old" data automatically deleted. If you're trying to make it behave like that, you're taking an approach that's not compatible with what Splunk is and how it works.

[abhayneilam]

If I use inputlookup then how do I extract the fields...I have written in transforms.conf and edited inputs.conf and indexes.conf, props.conf..

Do I not need of those conf file ?

I want If I have 5 rows , then after edition also It should show 5 rows but SPLUNK is showing 10 rows with duplicate data..

Please help is there any other way to solve this issue