topic Re: What if tail -f option is enabled in Splunk Search

What if tail -f option is enabled

pramodkumar — Wed, 02 Jan 2013 06:10:12 GMT

Hi,
What specifically the tail -f option do, in which scenario it works perfect.
Please any example would be great..

Re: What if tail -f option is enabled

roychen — Wed, 02 Jan 2013 07:31:32 GMT

Hi,

I'm afraid your question is not very specific. Do you mean the followTail option in inputs.conf, or something else?

Re: What if tail -f option is enabled

Drainy — Wed, 02 Jan 2013 08:25:34 GMT

This isn't really a Splunk related question but you're best reading the man pages for tail to learn;

http://unixhelp.ed.ac.uk/CGI/man-cgi?tail

Edit based on comment;

The documentation is pretty clear on its purpose and use, for reference I've pasted it below;

followTail = [0|1]
* WARNING: Use of followTail should be considered an advanced administrative action.
* Treat this setting as an 'action'.  That is, bring splunk up with this
  setting enabled.  Wait enough time for splunk to identify the related files,
  then disable the setting and restart splunk without it.
* DO NOT leave followTail enabled in an ongoing fashion.
* Can be used to force splunk to skip past all current data for a given stanza. 
  * In more detail: this is intended to mean that if you start up splunk with a
    stanza configured this way, all data in the file at the time it is first
    encountered will not be read.  Only data arriving after that first
    encounter time will be read.
  * This can be used to "skip over" data from old log files, or old portions of
    log files, to get started on current data right away.
* If set to 1, monitoring begins at the end of the file (like tail -f).
* If set to 0, Splunk will always start at the beginning of the file. 
* Defaults to 0.

http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf

Re: What if tail -f option is enabled

pramodkumar — Wed, 02 Jan 2013 08:34:12 GMT

yes am referring to followTail option in inputs.conf

Re: What if tail -f option is enabled

pramodkumar — Sat, 05 Jan 2013 17:59:59 GMT

does it mean, only the new events added to the file those events will be picked, rest will be skipped off.. if its like that then my requirement is sufficed..