To ensure Splunk fully reindexes a file whenever the datestamp changes, consider using initCrcLength and crcSalt in your inputs.conf. The default CHECK_METHOD = modtime may not detect content changes if the file is overwritten with similar data. Including a unique timestamp in the file or path can also help.
... View more