Knowledge Management

Modtime is newer than stored, will reread file with 9.x.x

hrawat
Splunk Employee
Splunk Employee

CHECK_METHOD = modtime is not working as expected due to a regression in 9.x as there is wrong calculation which will lead to un-expected re-reading of a file.
Until next patch, use following workaround for inputs with CHECK_METHOD = modtime
In inputs.conf set following for impacted stanza

time_before_close=0




 

Tags (1)

fratamicod
Explorer

I'm seeing this issue on 9.3.0. Which version of 9.x.x was this patched?

0 Karma

hrawat
Splunk Employee
Splunk Employee

9.2.1 and above has the fix. May be you want to explain your issue with configs.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...