I have a log file that I need to have the splunkforwarder re-start from the very beginning.
my index.conf entry is this:
[monitor:///var/log/app/prod/hostname0050.log]
sourcetype=cmsdk_log
index=app
host=hostname0050
followTail=0
However I keep getting this message in the splunkd.log
04-27-2012 10:15:27.053 -0700 INFO WatchedFile - Will begin reading at offset=1361969172 for file='/var/log/app/prod/hostname0050.log'.
I would like it to re-read the entire file to get the past history.
Any thoughts?
... View more