Splunk Search

log file rotation

rupesh212121
Explorer

When splunk is watching a directory for log files will it reindex a file that gets rotated? I am trying to make sure that some of my logs are not getting indexed twice.

Example:

file1.log gets changed to file1.log12212010 service creates new file1.log and continues logging

where can i save the rotated log file or does splunk have any facility to save the rotated logs. please answer. thank u rupesh.

Tags (1)
0 Karma

Ayn
Legend

No, Splunk has a number of ways of recognizing the file's content other than the actual filename so it will not reindex a file just because the name changed.

As for the second question I'm not sure what you mean - Splunk itself has no functionality (to my knowledge) for rotating, moving or otherwise modify the log files. All it does is index the data contained in the log files to its own database.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...