please need your support as SPLUNK didn't parse all files from same path, i.e for example in my inputs.conf there are 2 stanza to monitor two paths. each path has around 1250 files, so i should find around 2500 files when searching for files.
i updated inputs.conf with (crcSalt = and initCrcLength = 2000) and nothing occurred
i found only the exact number of files after restarting SPLUNK service, so is it a mandatory to restart splunk every time i got the files to be parsed ?!!!
[monitor:///home/Path1/*.xml]
disabled = 0
host_segment = 4
index = index1
sourcetype = sourcetype1
recursive = true
crcSalt =
initCrcLength = 2000
Yes, for changes in inputs.conf
file, you have to restart Splunk instance.
Alternatively, you can refresh Splunk instance without restart using '../debug/refresh' endpoint. But, it may not be applicable for all config file change.
http://<yoursplunkserver>:8000/en-US/debug/refresh
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Configurationfilechangesthatrequirerestart