Given the timing of your events (log file newer than fishbucket), you'd be in case #3. There would be an error message like this in your splunkd.log. Checksum for seekptr didn't match, will re-read entire file='/path/to/files/server.log' ... View more

Thanks! It's 60 minutes on mine and that matches what I am seeing. ... View more

Ah. Ok. We have ProxyHTMLEnable set globally to on. I'll change that to only directly set it where needed. Working great now. Thank you!! ... View more