I have an application that uses rolling logging. The rolling logging works as such:
So if I monitor all of the files that match "log_file.*", will I have a bunch of duplicated data each time the file rolls over?
Should I just monitor "log_file.txt" in this instance?
The answer is somewhat "it depends", but the default settings are likely sane enough to prevent re-indexing old data. Splunk uses the first initCrcLength
bytes of a file to determine if it is a new file or not. That setting can be changed as necessary, and other settings can also be changed to force Splunk to use the filename to assist it in determining uniqueness, but it sounds like you want the normal behavior that a monitor
input would give you.
For more information on the different settings you can use for your inputs check out the inputs.conf spec.
The answer is somewhat "it depends", but the default settings are likely sane enough to prevent re-indexing old data. Splunk uses the first initCrcLength
bytes of a file to determine if it is a new file or not. That setting can be changed as necessary, and other settings can also be changed to force Splunk to use the filename to assist it in determining uniqueness, but it sounds like you want the normal behavior that a monitor
input would give you.
For more information on the different settings you can use for your inputs check out the inputs.conf spec.
Did you mean inputs.conf
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf ?
props.conf
only has initCrcLength
but anything else is configurable in inputs.conf
cheers, MuS
Yes, thanks! I had linked to the correct page but put props for the text instead.
It also very much depends on whether you are using crcSalt = <SOURCE>
or not.