Hi,
We are looking to change the location of the modinputs checkpoints.
By default, the checkpoints are in $SPLUNK_HOME/var/lib/splunk/modinputs/
I did not find any parameter to change this.
Do you know if/how we can do this?
FYI, the needs comes from our citrix servers, they start on a golden image, but have their eventlogs in a persistent location (D drive). So each time the sever reboot, we loose the checkpoints and all the events in the eventlogs are forwarded, so we have duplicate events in splunk. We'd like to define the location of the checkpoints to the persistent location.
If not possible we'll have to use the current_only parameter in the input, but we'll lose some startup event and we'd like to avoid this.
Thanks
Michael
... View more