WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file

[max8006]

Hello
I have a script that writes a log file of the current month. The information is exported from a database. It always writes the whole month. It does not matter if there are new entries or not. If there are new entries, they will be appended to the end of the file.
This log file is monitored by Splunk. I think the re reading takes place at the moment the script fills the line of the log file and is not finished, and at the same time Splunk checks the file and recognizes there is a difference.
My workaround is to copy the file to a different location when the script finishes exporting. And Splunk only checks the file at the new copy location. Now I do not have such reading errors anymore.
My question is whether my approach is right or if there is a better way. The problem I have is that I can not access the database directly.
thank you in advance

[martin_mueller · Accepted solution]

If you're rewriting files from the beginning then yeah, writing them elsewhere and finally moving/renaming them to a splunk-monitored location is the way to go.

[ddrillic]

Maybe you can write the output from the DB into a file and compare its contents against the Splunk's monitored file and add to the Splunk one the difference. Like this you hide your process from Splunk.