Moving away indexed files after indexing

[wsw70]

Hello,

I index files in a directory. The files are normally created for the sake of being indexed and do not change after indexing (in other words, they are not updated - once created they are frozen).

I noticed that they are sometimes reindexed (not sure why but I can wildly guess they were "touch"-ed (linux speaking) or otherwise modified (their attributes, not content), which triggered a reindexation).

Is there a way to instruct splunk to move then to another predefined directory after they have been indexed?
Alternatively: make it so that splunk would index them only once, no matter the changes (I know that this is possible for a single file but apparently not for a monitored directory)

The first solution (move them away) would be ideal.

Thank you.

[Ayn · Accepted solution]

Splunk has no mechanisms for performing file-system operations like that (other than reading files, of course).

You should check splunkd.log to see what causes Splunk to reindex files. Even if files are touched, Splunk should not reindex them because it keeps a CRC checksum and read offset to see if a file really has changed and if so where it should start reading.

[wsw70]

Thanks. I will have a closer look at splunkd.log as there are interesting messages there anyway (never had a look before)