Given this monitor stanza
[monitor://blah/var/log/blah.log]
What is the expected behavior during log rotation if the log rotates to log.1 before the tailing processor has reached the end of the file? Will the contents of the rolled file continue to be indexed until the pointer reaches EOF? In essence, if splunk is lagging behind the end of the file as it rotates and this stanza is only catching .log and not log.1, what can i expect?
... View more