Put it into a lookup, then
Or change retention on the index to be longer
Reingesting daily is … highly inideal
May 28, 2020 at 03:44PM
via reddit https://www.reddit.com/r/Splunk/comments/gsc5is/reindexing_the_same_unchanged_log_file_every_day/fs4fj9d?utm_source=ifttt