Splunk Search

Data index

splunker_123
Path Finder

Hi

I've a question regarding the log file sent by forwarders to indexers

Assume , a log file called abc.log is indexed in the splunk indexer this morning and by afternoon the log is updated,so now ,will the log file will be sent to indexer again by the forwader? OR
only updated portion will be send to the indexer? what is the default nature? If I have to set up spluk in above fashion what will be the configuration I'll have to do please?

Thanks

Tags (1)
0 Karma
1 Solution

dmaislin_splunk
Splunk Employee
Splunk Employee

Just the updated log information is sent.

View solution in original post

dmaislin_splunk
Splunk Employee
Splunk Employee

Just the updated log information is sent.

splunker_123
Path Finder

Thanks..Is this nature by default in splunk? or do we have to tune the configuration to make it happen?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...