Will changing initCRCLength cause data to be reindexed?

[okrabbe_splunk]

Will changing initCRCLength cause all data to be reindexed of does it somehow recognize that it already indexed the old file? The problem is naturally around IIS logs but we want to keep the option open for log rotation in the future and don't want to use crcsalt.

[okrabbe_splunk · Accepted solution]

The answer to this question is yes, this will cause the data to be reindexed.

One possible workaround would be to use ignoreOlderThan on your inputs to limit how much is reindexed.