https://community.splunk.com/t5/Getting-Data-In/Changing-inputs-conf-to-include-previously-scanned-files/m-p/130613#M26859 <P>When initially set up my splunk install is set to capture only the most recent version of a log:</P> <P>/path/to/log/dir/logfile.</P> <P>Well, sometimes, due to maintenance, etc., Splunk is shut off and when restarted I have to go through the process of reloading (via oneshot) the data from logfile.1 logfile.2 logfile.3 . . . to get caught up.</P> <P>On systems I've set up, I just have inputs.conf configured for /path/to/log/dir with a whitelist on logfile*$</P> <P>What will happen if I change the previous configuration? Will it re-index all the previous logfile.\d+$ files or is it self-aware enough to not do that? </P> Wed, 06 Nov 2013 13:49:49 GMT tyronetv 2013-11-06T13:49:49Z https://community.splunk.com/t5/Getting-Data-In/Changing-inputs-conf-to-include-previously-scanned-files/m-p/130613#M26859 <P>When initially set up my splunk install is set to capture only the most recent version of a log:</P> <P>/path/to/log/dir/logfile.</P> <P>Well, sometimes, due to maintenance, etc., Splunk is shut off and when restarted I have to go through the process of reloading (via oneshot) the data from logfile.1 logfile.2 logfile.3 . . . to get caught up.</P> <P>On systems I've set up, I just have inputs.conf configured for /path/to/log/dir with a whitelist on logfile*$</P> <P>What will happen if I change the previous configuration? Will it re-index all the previous logfile.\d+$ files or is it self-aware enough to not do that? </P> Wed, 06 Nov 2013 13:49:49 GMT https://community.splunk.com/t5/Getting-Data-In/Changing-inputs-conf-to-include-previously-scanned-files/m-p/130613#M26859 tyronetv 2013-11-06T13:49:49Z https://community.splunk.com/t5/Getting-Data-In/Changing-inputs-conf-to-include-previously-scanned-files/m-p/130614#M26860 <P>Normally splunk will not re-index a file it has already seen (as it keeps track of what has already been indexed in a special index called the <CODE>fishbucket</CODE>).</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.0/Data/MonitorFilesAndDirectories#How_monitor_works_in_Splunk">http://docs.splunk.com/Documentation/Splunk/6.0/Data/MonitorFilesAndDirectories#How_monitor_works_in_Splunk</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.0/Data/HowLogFileRotationIsHandled">http://docs.splunk.com/Documentation/Splunk/6.0/Data/HowLogFileRotationIsHandled</A><BR /> <A href="http://wiki.splunk.com/Community:HowSplunkReadsInputFiles">http://wiki.splunk.com/Community:HowSplunkReadsInputFiles</A><BR /> <A href="http://blogs.splunk.com/2008/08/14/what-is-this-fishbucket-thing/">http://blogs.splunk.com/2008/08/14/what-is-this-fishbucket-thing/</A></P> <P>/K</P> Wed, 06 Nov 2013 15:38:16 GMT https://community.splunk.com/t5/Getting-Data-In/Changing-inputs-conf-to-include-previously-scanned-files/m-p/130614#M26860 kristian_kolb 2013-11-06T15:38:16Z