How to delete old data before ingesting new data from CSV - Refresh Data?

[garrywilmeth]

I have a few spreadsheets that are ingested into Splunk daily.  What is the best method to refresh the data, so I don't end up with duplicates? I am looking to do something like this:

Today: Ingest spreadsheet.csv
Tomorrow: delete previous data for spreadsheet.csv and then ingest new data

Thanks,

Garry

[gcusello]

Hi @garrywilmeth,

if you're not interested to historical series, you can use the solution from @scelikok .

If instead you need to know the historical situation, you should ingest new data in an index and use time in your searches to identify the values to use.

Ciao.

Giuseppe

[scelikok]

Hi @garrywilmeth,

It seems better to use your CSV files as a lookup.

https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ConfigureCSVlookups