Possible case are: * check folder permission, maybe some program change change the permission. * try open the file with some text editor (ext; notepad++) if can not open, some programs may be using that file. * if open, try change some character, (change 1 or 2 word than save)if can not save, check elsewhere. the splunk did not change or touch the file, just read or copy the file to the splunk server ... View more