topic Re: Can Universal forwarder forward the delta changes from a file to splunk instance? in Getting Data In

Can Universal forwarder forward the delta changes from a file to splunk instance?

royimad — Thu, 21 Mar 2013 13:17:30 GMT

I need to know if a universal forwarder could send only the delta changes in a log or need to forward the hole log to the splunk instance.

Re: Can Universal forwarder forward the delta changes from a file to splunk instance?

Ayn — Thu, 21 Mar 2013 19:01:37 GMT

I think you need to clarify what your definition of those two cases are. Send only the delta when? Send the whole log when? Forwarders obviously will not send the whole log file each and every time an event is added to it.

Re: Can Universal forwarder forward the delta changes from a file to splunk instance?

kristian_kolb — Thu, 21 Mar 2013 20:03:11 GMT

As I answered you in a similar question, the forwarder will keep track on the how far into a file it has read, so that it can determine which events have been added since it last looked.

It will also be able to determine if a filed has been rotated, though in some circumstances you will have to make a few configuration changes to make the forwarder understand that it's looking at a new file.

See the "Getting Data In" section in the docs.
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Monitorfilesanddirectories
http://docs.splunk.com/Documentation/Splunk/latest/Data/Howlogfilerotationishandled

Hope this helps,

Kristian

Re: Can Universal forwarder forward the delta changes from a file to splunk instance?

royimad — Fri, 22 Mar 2013 07:51:03 GMT

Thanks, So sending the delta is the default behavior?

Re: Can Universal forwarder forward the delta changes from a file to splunk instance?

Ayn — Fri, 22 Mar 2013 12:34:23 GMT

It's the only behaviour - I don't understand how else it would work.