Hello, Trying to monitor a log which changes the first few characters of the log every few minutes, this seems to cause Splunk UF to re-index the whole log each time, since it see's the first few characters as being different which causes a difference crc. I have tried many different options but nothing seems to be working properly to index this log properly and without duplicates. Example of log below. .log at 02:53 eÎ5 eÎ5 014500000000000003FGR0002TRA00102021/01/24001202:53 32.0850006 same .log a few minutes later at 02:56 ØT& ØT& 014500000000000003FGR0002TRA00102021/01/24001202:53 32.0850006 014500000000000003FGR0002TRA00102021/01/24001202:55 42.0150006 014500000000000003FGR0002TRA00102021/01/24001202:56 33.0110006 Seems the App that generates this log changes these characters for some reason and there is no way to capture the data without getting duplicate data. Any suggestions? Thanks
... View more