https://community.splunk.com/t5/Splunk-Enterprise/Problem-with-indexing-the-same-filename/m-p/569880#M10252 <P>Good afternoon!</P><P>I have a <SPAN>XPRT_002_SYSAT-41777_202110020712.csv</SPAN> file. After some time, exactly the same <SPAN>XPRT_002_SYSAT-41777_202110020712.csv</SPAN> file appears in my directory, with exactly the same content, but with a different modification time. In this case, the system indexes all events from this file twice and I have duplicates. I know that they can be filtered by means of dedup _raw, but it is not my way because it very strongly worsens search performance. Are there any other ways to configure indexing based on file changes rather than name and size, and if they match, do not index again?</P><P>Tried:</P><P>crcSalt = &lt;SOURCE&gt;</P><P>CHECK_METHOD = modtime</P> Wed, 06 Oct 2021 13:10:39 GMT krylov 2021-10-06T13:10:39Z https://community.splunk.com/t5/Splunk-Enterprise/Problem-with-indexing-the-same-filename/m-p/569880#M10252 <P>Good afternoon!</P><P>I have a <SPAN>XPRT_002_SYSAT-41777_202110020712.csv</SPAN> file. After some time, exactly the same <SPAN>XPRT_002_SYSAT-41777_202110020712.csv</SPAN> file appears in my directory, with exactly the same content, but with a different modification time. In this case, the system indexes all events from this file twice and I have duplicates. I know that they can be filtered by means of dedup _raw, but it is not my way because it very strongly worsens search performance. Are there any other ways to configure indexing based on file changes rather than name and size, and if they match, do not index again?</P><P>Tried:</P><P>crcSalt = &lt;SOURCE&gt;</P><P>CHECK_METHOD = modtime</P> Wed, 06 Oct 2021 13:10:39 GMT https://community.splunk.com/t5/Splunk-Enterprise/Problem-with-indexing-the-same-filename/m-p/569880#M10252 krylov 2021-10-06T13:10:39Z