Getting Data In

Re-indexing the complete file

NAVEEN_CTS
Path Finder

I have a file that is monitored at the UF . File gets frequently updated (same file). In some occasion , already existing fields might change and in some occasion additional lines will be added either at the bottom , or at any part of the file.

Problem here is, if changes occurring at the beginning or in first few lines....the complete file gets indexed, whereas if the changes occurring at the bottom . (for ex : if 2 additional lines added at bottom) only those 2 lines are indexed.

Requirement:

In whatever the case , if there are changes in the file , i want the file to be completely re-indexed. If this is possible please help me with the steps.

Thanks in Advance

0 Karma

koshyk
Super Champion

The idea is to index the whole file everytime, then the following thread might help you.
https://answers.splunk.com/answers/5426/entire-file-contents-as-a-single-event.html

0 Karma
Get Updates on the Splunk Community!

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...

Join Us at the Builder Bar at .conf24 – Empowering Innovation and Collaboration

What is the Builder Bar? The Builder Bar is more than just a place; it's a hub of creativity, collaboration, ...

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...