Props

CHECK_METHOD = [endpoint_md5|entire_md5|modtime]

• Set CHECK_METHOD to "endpoint_md5" to have Splunk software perform a checksum
  of the first and last 256 bytes of a file. When it finds matches, Splunk
  software lists the file as already indexed and indexes only new data, or
  ignores it if there is no new data.
• Set CHECK_METHOD to "entire_md5" to use the checksum of the entire file.
• Set CHECK_METHOD to "modtime" to check only the modification time of the
  file.
• Settings other than "endpoint_md5" cause Splunk software to index the entire
  file for each detected change.
• This option is only valid for [source::<source>] stanzas.
• This setting applies at input time, when data is first read by Splunk
  software, such as on a forwarder that has configured inputs acquiring the
  data.
• Default: endpoint_md5

新しいファイルを読み込む際に、input.confのcrcSaltと併せて確認される。
endpoint_md5以外を設定した場合、ファイルの取込み重複を発生させる可能性がある。