Can I resolve this splunk dashboard index auto refresh / resync issue?

[pp3295]

hi all,

we  are creating one dashboard having two tables , in that we have set different folder locations for monitoring. 

BAU table 1 query = source="F:\\Logshipping\\Export\\BAU\\*" host="FinIQDB-DR" index="index_bau" EP_ER_QuoteRequestId= * EP_ER_QuoteRequestId != "EP_ER_QuoteRequestId"| dedup EP_ER_QuoteRequestId| table EP_ER_QuoteRequestId, orderStatus,EP_ExternalOrderId,ER_Created_At,ER_Created_By,EP_Order_Requested_At,EP_Order_Response_At,ER_Type,EP_ordertype,ER_UnderlyingCode,ER_LimitPrice1,ER_LimitPrice2,ER_LimitPrice3 ,source

DR table 2 query = source="F:\\Logshipping\\Export\\DR\\*" host="FinIQDB-DR" index="index_dr" EP_ER_QuoteRequestId= * EP_ER_QuoteRequestId != "EP_ER_QuoteRequestId"| dedup EP_ER_QuoteRequestId| table EP_ER_QuoteRequestId, orderStatus,EP_ExternalOrderId,ER_Created_At,ER_Created_By,EP_Order_Requested_At,EP_Order_Response_At,ER_Type,EP_ordertype,ER_UnderlyingCode,ER_LimitPrice1,ER_LimitPrice2,ER_LimitPrice3 ,source

** Screenshot

1. We are getting updated records  in BAU table ,whenever file is updated into folder 

2. We are not able to get updated records in DR table , when file is updated, in that case we have to 

delete an index and re-create it .  then new records are populated in the grid.

thanks.

[ITWhisperer]

What is the difference between the configuration for the BAU file monitoring and the DR file monitoring?

Are the new events available from the search and reporting app, just not in the dashboard table?

Do you get the new events if you refresh the browser window?

[pp3295]

thanks for your reply.

What is the difference between the configuration for the BAU file monitoring and the DR file monitoring?

pp= actually we have added two local inputs under files and directories.  as folder continuous monitor and created two different index as index_bau, index_dr for them and assigned to them.

Are the new events available from the search and reporting app, just not in the dashboard table?

pp= in search we are also not getting new events, for populate new events we have to delete existing index and re-create , then search and dashboard shows new events.

Do you get the new events if you refresh the browser window?

pp= after browser refresh , index not refreshed, we are using splunk on windows  10

[isoutamo]

Hi
Can you post a real inputs.conf files which are used to collect those events. Also check on client side that those are correct ones with splunk btool.
Also are there any props.conf and transforms.conf used on your environment?
Is this one node installation or have you separate nodes where you have installed UF's to collect those events?
r. Ismo

[pp3295]

Not using any forwarder, just single Splunk server installation to monitor Local file.

[isoutamo]

Are those local drives or network shares mapped to local drive letters?
Which user you are using to run splunk?

[pp3295]

thanks for your reply.

Our F:\\Logshipping\\Export\\BAU\ or F:\\Logshipping\\Export\\BAU\ is local shared folder .

we are copying files from other vm to this location and we are using admin user