Trying to watch SAP work logs. With some of the development logs, I continually get Checksum for seekptr didn't match, will re-read entire file. Doing a diff on the log files I get an error about the last line not ending with a newline. But diff does just show the new entries. Splunk is currently reindexing the entire files every time there are new lines appended. I have already tried the CHECK_METHOD=modtime and entire_md5, but that causes the files to be completely reindexed every time they change.
diff: Missing newline at the end of file A diff: Missing newline at the end of file B
Is there a setting or something to force splunk to only read the new lines?