Getting Data In

How to stop Splunk forwarder from re-indexing files when I edit them with vi?

bhupalbobbadi
Path Finder

Splunk forwarder is re-indexing files when I edit them with vi.
Has anybody seen this before?

I have used the below configs, still it is re-indexing again and again.

crcSalt =' <' SOURCE '>'
initCrcLength = 2560

TIA for your help.

0 Karma
1 Solution

codebuilder
SplunkTrust
SplunkTrust

This is expected behavior. The hash value of your file changes if you modify it, even if the filename does not change.
The short answer is, you should not manually modify files that are being monitored by a Splunk forwarder.

If you do manually modify it (for whatever reason), change the file extension (add a timestamp, change .log to .log.bak, etc.) and blacklist that file extension.

There are multiple solutions to this issue, but the easiest is to not manually modify the file. This is one case where Splunk is behaving 100% as expected.

----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

0 Karma

codebuilder
SplunkTrust
SplunkTrust

This is expected behavior. The hash value of your file changes if you modify it, even if the filename does not change.
The short answer is, you should not manually modify files that are being monitored by a Splunk forwarder.

If you do manually modify it (for whatever reason), change the file extension (add a timestamp, change .log to .log.bak, etc.) and blacklist that file extension.

There are multiple solutions to this issue, but the easiest is to not manually modify the file. This is one case where Splunk is behaving 100% as expected.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

bhupalbobbadi
Path Finder

sounds reasonable. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...