Here is how we removed all 200 entries in the haproxy.log. Simply added this line to /etc/rsyslog.conf:   if ($programname == "haproxy" and not ($msg contains " 200 ")) then /var/log/haproxy.log       ... View more

I'm seeing a similar problem.  The file hashes are the same but the 'stat <file>' shows the metadata has changed.  Splunk seems to also re-read a file if the metadata has changed. Did you get a resolution? ... View more

Hi @jkostovich , Did you ever resolve this? If not, do you know if you had a customer management port configured? You can check via Splunk Web by going to Settings -> Server Settings -> General Settings and checking the management port or checking the mgmtHostPort set in the [settings] stanza of web.conf. If your management port is different from the default of 8089, this could indicate a connection to Bug ADDON-17613, where the AWS Add-On has issues not recognizing custom management ports. The solution would be to set your management port to 8089 if possible or set a routing table on the local machine to map/forward 8089 to your custom port. ... View more