Yeah, so that messes things up. Splunk keeps track of the last line it has read and expects new logs to be added after that. In your case, that last line is the line with </Events> . When a new event is added, it is added on that same line and the </Events> is shifted down. So splunk detects that the last line it had already read is now changed and that triggers re-reading the entire file. I don't see any settings in inputs.conf that can change that behavior, so I guess looking at the data source to see if it can log in a different way is your best bet. I've upgraded my comment to an answer, so you can accept it. ... View more