I had this issue after updating from 8.2.1 to 8.2.10. It was found that there were two monitors for tracker.log so I disabled the one I found in $SPLUNK_HOME/etc/system/local/inputs.conf: [monitor://$SPLUNK_HOME\var\spool\splunk\tracker.log*] disabled = 1 After Splunk restarted, there were no issues. I hope this helps someone.  ... View more