Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: How to stop Splunk forwarder from re-indexing ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk forwarder is re-indexing files when I edit them with vi.
Has anybody seen this before?
I have used the below configs, still it is re-indexing again and again.
crcSalt =' <' SOURCE '>'
initCrcLength = 2560
TIA for your help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is expected behavior. The hash value of your file changes if you modify it, even if the filename does not change.
The short answer is, you should not manually modify files that are being monitored by a Splunk forwarder.
If you do manually modify it (for whatever reason), change the file extension (add a timestamp, change .log to .log.bak, etc.) and blacklist that file extension.
There are multiple solutions to this issue, but the easiest is to not manually modify the file. This is one case where Splunk is behaving 100% as expected.
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is expected behavior. The hash value of your file changes if you modify it, even if the filename does not change.
The short answer is, you should not manually modify files that are being monitored by a Splunk forwarder.
If you do manually modify it (for whatever reason), change the file extension (add a timestamp, change .log to .log.bak, etc.) and blacklist that file extension.
There are multiple solutions to this issue, but the easiest is to not manually modify the file. This is one case where Splunk is behaving 100% as expected.
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sounds reasonable. Thanks.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
