Suppose I am monitoring a file that has 10 lines in it. These lines are already sent to splunk.
Now, if I overwrite this file to have just 5 lines (in other words, my logwriter cleans the log file every time and write some new lines in it - we are reusing the log file that is being monitored)
Will this cause any problems to splunk indexing?
www.webadminblog.com/index.php/splunk-best-practices/
take a look on th 4th paragraph.
here is two scenario for you:
Hi venkat;
If when you added your file to splunk, you have choose to upload the file, any time that you'll have updates for that file, you'll need to re-indexing the new file for splunk to take care of the update.
But if you choose to monitor the file (continuously index data from file and directory), you'll not need to re-index your file; you'll just need to overwrite the old file by the new file at the same location.
NB: The new file most have the same name like the old file.
In your case, choose the option that correspond to your needs.