topic Re: Reset splunk forwarder to read a file from a particular offset in Getting Data In

Reset splunk forwarder to read a file from a particular offset

raknair07 — Thu, 24 Jan 2013 02:45:08 GMT

Using btprobe with --reset causes the splunk forwarder to re-read the entire file. However i want the forwarder to read only from a particular offset, and not necessarily from the beginning of the file. Can i do that? Is there a way i can set the "sptr" attribute associated with each file, to a particular value.

Re: Reset splunk forwarder to read a file from a particular offset

Lowell — Thu, 04 Dec 2014 21:03:40 GMT

I think the answer is no. Added an upvote because I'd like an authoritative answer to this as well.

Re: Reset splunk forwarder to read a file from a particular offset

MuS — Thu, 04 Dec 2014 21:05:31 GMT

nice one - up voted as well

Re: Reset splunk forwarder to read a file from a particular offset

dwaddle — Mon, 06 Apr 2015 01:40:07 GMT

I would say there is no supported way to do this using the btprobe command. The btprobe tool itself is only barely supported - falling into the category of "Command Line Tools for Use with Support." Further, the documentation on btprobe does not discuss any way of accomplishing anything other than a 'full reset'.