Can Splunk writeback to the file that it's reading for reporting?
What are you trying to accomplish with writeback? Perhaps there is another solution to your problem.
No, Splunk does not write back to its input files. However, you can get Splunk to output search results or lookup tables. But these outputs don't go back to the monitored directories.
