This should be accepted as solution. This workaround works, not sure why Splunk hasn't put this workaround in the known issues section in the docs. ... View more

To ensure Splunk fully reindexes a file whenever the datestamp changes, consider using initCrcLength and crcSalt in your inputs.conf. The default CHECK_METHOD = modtime may not detect content changes if the file is overwritten with similar data. Including a unique timestamp in the file or path can also help.         ... View more