Will log files be re-indexed if I change inputs.conf?

[Derek]

Hi!

Probably a simple question, but I have a forwarder that is mointoring an entire directory all with all the files being set with a common sourcetype. There are several formats/sources of files in the directory and I want to change my inputs.conf to break them out into different sourcetypes so that I can get more granular in some of my field extractions and searches.

I know that Splunk has many built-in mechanisms that will keep it from re-indexing the same file and I want to make sure that's done at the raw file level and not based on any meta-data such as sourcetype etc.

Thanks!

[southeringtonp · Accepted solution]

Assuming you are working with monitor inputs, the files would should not be reindexed.

Splunk's detection of duplicate files is based on CRC checksums. The exception would be if you have configured a crcSalt, which will let you include a fixed string or the value of source as part of the comparison. Other metadata, including sourcetype, would not be a factor in detecting duplicates.

More information on the CRC calculation:
     http://www.splunk.com/base/Documentation/latest/Admin/Howlogfilerotationishandled