Issues with data ingestion from the same xml files with appended data/raw

[SplunkDash]

Hello,

I have xml source files in a location where SPLUNK HF installed on it...these files are updated with new data...that means no new files are created .....when new data comes in... existing files are appended, and new data added at the end of the existing files. I know SPLUNK has CRC to check duplicate entries based on the Hash Function. My question is.... will SPLUNK UF/HF be able to read only new data that is added at the end of existing file without any errors (or missing info) and send to the indexer. 

Any recommendations/thoughts would be highly appreciated. Thank you so much for your support.

[PickleRick]

Normally monitor inputs - as the name says - monitor files for changes. If there is data appended to the end of the file, it _should_ be read and ingested. There are some border cases where it fails, often involving sharing files over the network, but in general case - it should work pretty well.