Hi My issue is that I have txt file to index entirely each time it is modified (adding or suppression). At this time, it is indexing only new lines. My txt file example : id,name,app,env,start...
See more...
Hi My issue is that I have txt file to index entirely each time it is modified (adding or suppression). At this time, it is indexing only new lines. My txt file example : id,name,app,env,start,end
1234,test,splunk_app,dev,29-12-2020 15:00,29-12-2020 16:00 5678,test2,splunk_app2,dev,29-12-2020 15:00,29-12-2020 16:00 My inputs.conf : [monitor:///opt/splunk/etc/apps/<app>/bin/file.txt] index = test sourcetype = st disabled = 0 crcSalt = <SOURCE> initCrcLength = 2000 My props.conf : [st] SHOULD_LINEMERGE = false DATETIME_CONFIG = CURRENT FIELD_DELIMITER=, HEADER_FIELD_DELIMITER=, FIELD_QUOTE=" Can you tell me how to do that ? Thanks!