Hi, Thanks for your response. It stopped indexing 4/3/2021. And since then, the text file has been overwritten every hour with new contents, but for some reason, it is just not picking up the updated file. Also, the program creating the text file does not have the ability to give the file a new name everytime it generates it.
... View more
Hi all, i have a simple splunk app that monitors a folder and indexes a text file that is overwritten every hour. It works fine. Then all of a sudden, it just stops indexing, even as new files are created. Below are my configs. Any suggestion is appreciated inputs.conf [ monitor://E :\Splunk\ccure\AllSites\*.txt] sourcetype = ccure:allsite:csv index = security disabled = false [ monitor://E :\Splunk\ccure\Forced_Held\*.txt] sourcetype = ccure:door_csv index = security disabled = false props.conf [ccure:allsite:csv] SHOULD_LINEMERGE=false NO_BINARY_CHECK=true CHARSET=UTF-8 INDEXED_EXTRACTIONS=csv KV_MODE=none category=Structured disabled=false pulldown_type=true CHECK_METHOD=modtime [ccure:door_csv] SHOULD_LINEMERGE=true NO_BINARY_CHECK=true CHARSET=UTF-8 LINE_BREAKER=([\r\n]+) MAX_TIMESTAMP_LOOKAHEAD=180 disabled=false CHECK_METHOD=modtime SEDCMD-crop_extra_line=s/(?!match)Door Forced Report - InfoSec(?!match)($|([\r\n]+))//g TRANSFORMS-set=setnull
... View more