I am monitoring a directory which contains some xml file.
Suppose there is a file 1.xml exists in directory. Now I put another file 2.xml which contains almost similar data, but there is some change in the few lines at the end of the file .
Size of both files is the same.
changes exists in last 256 bytes.
Initial 256 bytes are same.
As per my knowledge
The monitoring processor picks up new files and reads the first and last 256 bytes of the file. This data is hashed into a begin and end cyclic redundancy check (CRC).
The begin CRC is matched against a database that contains all the CRCs of files Splunk has seen before, but the end CRC does not match. This means that Splunk has previously read the file but that some of the material that it read has since changed. In this case, Splunk must re-read the whole file.
But my file is not indexed.
Why is this happening?