There is a file which has same data but file is deleted after few hours and placed again with same data but different timestamp. Splunk has indexed the data once but I want an alert to be triggered whenever the timestamp of the file has changed. Since the file is not getting indexed again I am unable to take care of the same. Anything that can be done to solve this?
Hi,
If you want to reindex your data then your will have to add crcSalt in your inputs.conf.