https://community.splunk.com/t5/Getting-Data-In/Log-File-Rotation/m-p/20528#M3003 <P>It will not reindex your file. Splunk will not do this by default. Normally, it identifies a file using a hash of the first 256 bytes of the file content, and not the file path/name. (This can be overridden.) However, do note that if you rename and <EM>compress</EM> the file, it will be reindexed, but you can suppress this by blacklisting compressed files by the name.</P> Wed, 05 Jan 2011 05:26:04 GMT gkanapathy 2011-01-05T05:26:04Z https://community.splunk.com/t5/Getting-Data-In/Log-File-Rotation/m-p/20527#M3002 <P>When splunk is watching a directory for log files will it reindex a file that gets rotated? I am trying to make sure that some of my logs are not getting indexed twice.</P> <P>Example:</P> <P>file1.log gets changed to file1.log12212010 service creates new file1.log and continues logging.</P> Wed, 05 Jan 2011 05:05:53 GMT https://community.splunk.com/t5/Getting-Data-In/Log-File-Rotation/m-p/20527#M3002 snapfinger 2011-01-05T05:05:53Z https://community.splunk.com/t5/Getting-Data-In/Log-File-Rotation/m-p/20528#M3003 <P>It will not reindex your file. Splunk will not do this by default. Normally, it identifies a file using a hash of the first 256 bytes of the file content, and not the file path/name. (This can be overridden.) However, do note that if you rename and <EM>compress</EM> the file, it will be reindexed, but you can suppress this by blacklisting compressed files by the name.</P> Wed, 05 Jan 2011 05:26:04 GMT https://community.splunk.com/t5/Getting-Data-In/Log-File-Rotation/m-p/20528#M3003 gkanapathy 2011-01-05T05:26:04Z