"Generally speaking, I haven't seen the need for this though, as I see files indexed with almost no delay at all between when the files are updated and when the updates come into Splunk."
My experiments show that there's anywhere from a zero to 15 second delay in indexing, which seems to match up well with the answer to this post:
http://splunk-base.splunk.com/answers/6693/how-to-force-splunk-to-index-new-files-quickly
I've since found a solution for what I want to happen - use oneshot:
http://splunk-base.splunk.com/answers/684/after-fixing-propsconf-how-to-re-index-the-same-files-using-the-new-settings
which converts indexing from async to blocking - more appropriate for my usage scenario.
... View more