I have tried updating props with INDEXED_EXTRACTIONS = CSV after indexing happened this is not giving me any results and i still can see header in my events   I have tried/tested in our dev instance and changed the index name to main in inputs.conf and tested then it is working   So my question here is whether this Indexed_extractions = csv doesnt work after the indexing is already done ... View more

He is instructions where those files should be in different cases https://wiki.splunk.com/Community:HowIndexingWorks and https://www.aplura.com/assets/pdf/where_to_put_props.pdf.  ... View more

I believe you will have to update your inputs.conf and write a scripted input configuration to run the job on scheduled time.  https://docs.splunk.com/Documentation/Splunk/8.2.3/Admin/Inputsconf  Also the current behavior you mentioned might be due to the enablement of the crcSalt in the inputs.conf that looks for hash change of the file state and if it happens, indexes the new data. ... View more

We need more information.  Logging in to what?  Splunk or something else?  If something else then are you indexing the something's logins? What do you mean by "region"? ... View more