https://community.splunk.com/t5/Getting-Data-In/Monitoring-Log-File-provided-as-Days-of-Week-and-Hourly/m-p/181017#M36319 <P>So... each event is written once to <CODE>App-Hourly.log</CODE> and once to <CODE>App-$weekday$.log</CODE>?</P> <P>I'd monitor all seven Day-of-Week files from the forwarder and have the app people disable the duplicate hourly log entirely.</P> Sat, 27 Jun 2015 08:36:06 GMT martin_mueller 2015-06-27T08:36:06Z https://community.splunk.com/t5/Getting-Data-In/Monitoring-Log-File-provided-as-Days-of-Week-and-Hourly/m-p/181016#M36318 <P>We are provided a certain type of log in the following format:</P> <P><STRONG>App-Hourly.log <BR /> App-Mon.log<BR /> App-Tue.log <BR /> App-Wed.log<BR /> App-Thur.log <BR /> App-Fri.log <BR /> App-Sat.log <BR /> App-Sun.log</STRONG></P> <P>The 'Hourly' log is rotated hourly and 'Days of the Week' are rotated daily.</P> <P>What would be the best way to feed these logs into Splunk from the Forwarder without duplicating events?</P> Sat, 27 Jun 2015 06:04:44 GMT https://community.splunk.com/t5/Getting-Data-In/Monitoring-Log-File-provided-as-Days-of-Week-and-Hourly/m-p/181016#M36318 pjohnson1 2015-06-27T06:04:44Z https://community.splunk.com/t5/Getting-Data-In/Monitoring-Log-File-provided-as-Days-of-Week-and-Hourly/m-p/181017#M36319 <P>So... each event is written once to <CODE>App-Hourly.log</CODE> and once to <CODE>App-$weekday$.log</CODE>?</P> <P>I'd monitor all seven Day-of-Week files from the forwarder and have the app people disable the duplicate hourly log entirely.</P> Sat, 27 Jun 2015 08:36:06 GMT https://community.splunk.com/t5/Getting-Data-In/Monitoring-Log-File-provided-as-Days-of-Week-and-Hourly/m-p/181017#M36319 martin_mueller 2015-06-27T08:36:06Z