Getting Data In

automatic update row in a index file

tissparkle
Explorer

Hi, I put a file in a specific directory to be indexed.
This file is update in a automatic way in a directory.

My issue is:
The index file makes a sum of the old file and the new file events and this is not correct for my use. for example: 1° file is 200 events - after that the second time file is 200+10 new events.
I would like to have a result of the index like 210 events not 410 events. I would like to understand if there is a different way to delete the old index and make everything automatic. thanks a lots

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Splunk always appends new data to the existing old data. Your case sounds like a lookup rather than indexed data, take a look at http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutlookupsandfieldactions for more info.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...