It depends on how you define "handle". Splunk expects a file it is monitoring to have new data added to the end. If the start of the file is overwritten then Splunk assumes the whole file is new and will re-ingest it, resulting in duplicate data. But the file is still handled!
---
If this reply helps you, Karma would be appreciated.
