Short question.
i have a directory that contains log files that look somethign liek this:
aaa.2012-05-22.log
but the system will compress them up after they go cold i.e.
aaa.2012-05-22.log.gz
in this case, will Splunk detect this new file in the directory that its monitoring and index the file? or would it still ignore it as the exact same log has already been indexed before.
The best would be to set your whitelist/blacklists to only grab .log files and ignore .log.gz, that said Splunk should open the file then determine based upon checksums that it's already been read.
The best would be to set your whitelist/blacklists to only grab .log files and ignore .log.gz, that said Splunk should open the file then determine based upon checksums that it's already been read.