We are "monitoring" a directory on a Splunk indexer host. This is the only input on this particular indexer. The indexing rate has remained constant at 5,000KB/s although no new files have been added to the directory for a few days. How is this possible? Could Splunk be re-indexing the files in this directory? The files have not changed in any way since they were copied over.
Ok, Not sure whats happening. So do you have have schedule task or cron job copy the directories/files over? Are you using CRCsalt? Install SOS (Splunk on Splunk) App or search the _internal index for the source which may give you some ideas.
Considerchanging your File checksum configuration to [endpoint_md5|entire_md5|modtime] in your props.conf.
If no luck up your logging channels on your indexer (I am not familar with all the logging channels):
Also keep in mind that Splunk indexes its own logs as well as those from your Forwarders which is stored in the _internal index. _internal does not count against your license.