Batch input. How to index .tar files quickly?

[rendie]

Hi,

I have batch index with next configuration:

[batch://path/to/files]

move_policy = sinkhole

index = maindata

And if in folder "files" are .csv files, then they will be indexed in seconds. But if in the folder are .tar.gz archive with CSV file inside, then he will be indexed only after restart Splunk.

How to index archive some quickly as .csv files?

Thanks.

[scelikok · Accepted solution]

Hi @rendie,

If you are putting the tar.gz files with the same name, this may be the reason you need to restart. 

Please try adding below check modified time setting and try;

[batch://path/to/files]
move_policy = sinkhole
CHECK_METHOD = modtime
index = maindata

If this reply helps you an upvote is appreciated.