Getting Data In

Will log files be re-indexed if I change inputs.conf?

Derek
Path Finder

Hi!

Probably a simple question, but I have a forwarder that is mointoring an entire directory all with all the files being set with a common sourcetype. There are several formats/sources of files in the directory and I want to change my inputs.conf to break them out into different sourcetypes so that I can get more granular in some of my field extractions and searches.

I know that Splunk has many built-in mechanisms that will keep it from re-indexing the same file and I want to make sure that's done at the raw file level and not based on any meta-data such as sourcetype etc.

Thanks!

Tags (1)
1 Solution

southeringtonp
Motivator

Assuming you are working with monitor inputs, the files would should not be reindexed.

Splunk's detection of duplicate files is based on CRC checksums. The exception would be if you have configured a crcSalt, which will let you include a fixed string or the value of source as part of the comparison. Other metadata, including sourcetype, would not be a factor in detecting duplicates.

More information on the CRC calculation:
     http://www.splunk.com/base/Documentation/latest/Admin/Howlogfilerotationishandled

View solution in original post

southeringtonp
Motivator

Assuming you are working with monitor inputs, the files would should not be reindexed.

Splunk's detection of duplicate files is based on CRC checksums. The exception would be if you have configured a crcSalt, which will let you include a fixed string or the value of source as part of the comparison. Other metadata, including sourcetype, would not be a factor in detecting duplicates.

More information on the CRC calculation:
     http://www.splunk.com/base/Documentation/latest/Admin/Howlogfilerotationishandled

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...