please need your support as SPLUNK didn't parse all files from same path, i.e for example in my inputs.conf there are 2 stanza to monitor two paths. each path has around 1250 files, so i should find around 2500 files when searching for files.
i updated inputs.conf with (crcSalt = ** and **initCrcLength = 2000) and nothing occurred
i found only the exact number of files after restarting SPLUNK service, so is it a mandatory to restart splunk every time i got the files to be parsed ?!!!
[monitor:///home/Path1/.xml]
disabled = 0
host_segment = 4
index = index1
sourcetype = sourcetype1
recursive = true
**crcSalt =
initCrcLength = 2000*
There are plenty of documents on the Splunk base that will go into details, take a look at the ignoreOlderThan
data stanza.
In answer to the question about restarting splunk, you don't need to do a full system restart. Just the below command
./splunk _internal call /services/data/inputs/monitor/_reload -auth