Getting Data In

Does anyone know why TZ change would cause a re-index?

wrangler2x
Motivator

I'm taking iis logs from an Exchange server via a forwarder on that system. Originally I had TZ = GMT on the etc/system/local/props.conf file for this sourcetype. But I have been having a problem with not being able to view events in real-time, so I thought maybe if the TZ was set on the forwarder's props.conf via the deployment app, that would fix that issue. I made the change, and after the reload deploy-server took I restarted splunkd to flush the TZ setting out which was removed on the indexer. This did nothing to help the issue, so I put everything back the way that it was before, again with a reload and for the indexer a splunkd restart. I received an email alert a short time later about this index (volume alert I wrote). Based on the size of the log file, looks like splunk reindexed the file twice. Why would changing the time zone cause that? I thought reindexing would happen only if the CRC for the beginning of the file changed. It is oky now, but just very bizarre...

0 Karma

wrangler2x
Motivator

I do not know for sure but my theory is that if the time zone changes then splunk sees the time of the file's modtime differently, and that causes the reindex. What made me think of this is this comment in the inputs.conf documentation:

alwaysOpenFile = 0 | 1

    If set to 1, Splunk opens a file to check if it has already been indexed.
    Only useful for files that don't update modtime.

Obviously, modtime plays a role in opening (and perhaps indexing or reindexing) or it would not be mentioned here. But in any case, whether this is a correct theory or not is moot, for I have the proof that it happens.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...