I have a file that after being rotated to say file.01, is being re-indexed. My monitor is set to monitor file*, and
About an hour after it's indexed I can see in splunkd.og "WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file" I can see from the files mtime that the file hadn't changed, but I get that message all of a sudden, and the entire file is re-indexed.
I don't have any crcSalt settings, from what I gather I shouldn't need them. Because of this I'm getting logs re-indexed post-rotation since it thinks something about the file changed.
Hi toddblacke
you should use the crcSalt option in your case, read the reason why in Mick's answer here -> http://splunk-base.splunk.com/answers/1568/windows-dhcp-log-files-too-small-to-match-seekptr-checksu...
cheers,
MuS