Getting Data In

Re-indexing the complete file

NAVEEN_CTS
Path Finder

I have a file that is monitored at the UF . File gets frequently updated (same file). In some occasion , already existing fields might change and in some occasion additional lines will be added either at the bottom , or at any part of the file.

Problem here is, if changes occurring at the beginning or in first few lines....the complete file gets indexed, whereas if the changes occurring at the bottom . (for ex : if 2 additional lines added at bottom) only those 2 lines are indexed.

Requirement:

In whatever the case , if there are changes in the file , i want the file to be completely re-indexed. If this is possible please help me with the steps.

Thanks in Advance

0 Karma

koshyk
Super Champion

The idea is to index the whole file everytime, then the following thread might help you.
https://answers.splunk.com/answers/5426/entire-file-contents-as-a-single-event.html

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...