Is there a way to add an interval setting to define the polling for a flat file? Not sure why it was requested but i was asked if it was possible and thought for sure it was only to find that it is currently not an option according to the inputs.conf section in the admin manual. https://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf I read that the default polling may be 1ms, to collect the modified file in near real time. I offered an alternative to create a sh or ps to Get-Content or some other scripting language and then set an interval to read the flat file at their desired time, however i would have to duplicate all of the options available for a file monitor stanza such as crcsalt and whitelist blacklist within the script which would have to be code reviewed and go through a lengthy pipeline. ANy help would be appreciated to say if this is a definite no go or if it is a possible ehancement request to splunk for the next version. thank you    

Hi, When i want to extract the fields from JSON (below) destination,messages, inflightMessages. This the one of the latest event: { "analytics": [ { "destination": "billing.events.prod", "messages": 0, "inflightMessages": 0 }, { "destination": "billing.events.dev", "messages": 0, "inflightMessages": 0 }, { "destination": "hub.values.prod", "messages": 0, "inflightMessages": 0 }, { "destination": "hub.fifo-prod", "messages": 0, "inflightMessages": 0 } ] } This is the spl i am using: index=myindex sourcetype=mysourcetype | spath input=_raw | table analytics{}.destination, analytics{}.messages, analytics{}.inflightMessages   Where i am getting in the intrested fields  "analytics{}.destination" for this when i move curser to see values and count associated, for each value showing count 2, when you search for one event.   Why this is happening what is the issue? This data generally mulesoftmq.      

Hello - Admitted new guy here, I have a heavy forwarder sending data from a MySql database table into Splunk once a day.  Works great.  But now I want to send the data from a 'customer' type table with about 200 rows, and I would like to replace the data every day, rather than append 200 new rows in the index every day. How is this best accomplished?  Tried searching, but I may not even be using the correct terminology.