Same file but different extension

attgjh1 — Fri, 22 Jun 2012 07:45:30 GMT

Short question.

i have a directory that contains log files that look somethign liek this:

aaa.2012-05-22.log

but the system will compress them up after they go cold i.e.

aaa.2012-05-22.log.gz

in this case, will Splunk detect this new file in the directory that its monitoring and index the file? or would it still ignore it as the exact same log has already been indexed before.

Re: Same file but different extension

mikelanghorst — Fri, 22 Jun 2012 16:54:19 GMT

The best would be to set your whitelist/blacklists to only grab .log files and ignore .log.gz, that said Splunk should open the file then determine based upon checksums that it's already been read.

topic Re: Same file but different extension in Getting Data In

Same file but different extension

Re: Same file but different extension