https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder-When-the-log-file-will-be-send-to-splunk/m-p/482411#M82668 <P>Thank you </P> Wed, 13 Nov 2019 08:31:14 GMT clementros 2019-11-13T08:31:14Z https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder-When-the-log-file-will-be-send-to-splunk/m-p/482409#M82666 <P>Hi, </P> <P>I'm currently monitoring log files on unix server. Jobs application write log file in a directory. <BR /> I want to monitor only log file that is finished to be write. How i can do that ? </P> <P>I don't want splunk to compare the beginning of the file to know if a file was already send to the indexer because if new lines are added to this file the forwarder will not see it. </P> <P>If the forwarder compare last lines to see if a file is new, it will sent the same file multiple time rights ? </P> <P>Can you help me please ? </P> Tue, 12 Nov 2019 14:21:04 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder-When-the-log-file-will-be-send-to-splunk/m-p/482409#M82666 clementros 2019-11-12T14:21:04Z https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder-When-the-log-file-will-be-send-to-splunk/m-p/482410#M82667 <P>By default, forwarders read new lines from monitored files and send only the new data to indexers.</P> Tue, 12 Nov 2019 15:44:15 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder-When-the-log-file-will-be-send-to-splunk/m-p/482410#M82667 richgalloway 2019-11-12T15:44:15Z https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder-When-the-log-file-will-be-send-to-splunk/m-p/482411#M82668 <P>Thank you </P> Wed, 13 Nov 2019 08:31:14 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder-When-the-log-file-will-be-send-to-splunk/m-p/482411#M82668 clementros 2019-11-13T08:31:14Z