I know that changing initCrcLength
option cause reindex and ignoreOlderThan
option is workaround.
https://answers.splunk.com/answers/79250/will-changing-initcrclength-cause-data-to-be-reindexed.html
But if target is the log updated frequently, how can I avoid reindex?
Also, If I change initCrcLength
, previous crc information in fishbucket will be cleared?
Does adding crcSalt
option causes reindex?
Also does it clear previous crc information in fishbucket?
If someone knows about it, please tell me.
hi @yutaka1005 ,
You can go through this link. This might help you.
https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Howlogfilerotationishandled
I am not sure that I understand your question. The functioning of crcSalt and initCrcLength are explained well in the docs. But what are you trying to archieve exactly?
Skalli
Thank you for comment.
What I want to know is the following two points.
Is reindex occured if I set crcSalt =
option?
The workaround for preventing reindex caused by changing initCrcLength
is "ignoreOlderThan".
But "ignoreOlderThan" option sees the update time of the file, so it will not be effective for files that are frequently updated.
So I want to know method of reindex prevention caused by changing initCrcLength
, when I monitoring frequently updated files.