I have a file that after being rotated to say file.01, is being re-indexed. My monitor is set to monitor file*, and
About an hour after it's indexed I can see in splunkd.og "WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file" I can see from the files mtime that the file hadn't changed, but I get that message all of a sudden, and the entire file is re-indexed.
I don't have any crcSalt settings, from what I gather I shouldn't need them. Because of this I'm getting logs re-indexed post-rotation since it thinks something about the file changed.
