All Apps and Add-ons

Can Splunk 8.1.3 handle circular log?

MuratKuru
Explorer

Splunk Enterprise
Version:8.1.3

Hi All
Can Splunk Enterprise Version:8.1.3 handle circular log?

 

Labels (1)
Tags (1)
0 Karma
1 Solution

MuratKuru
Explorer

What I'm taking out of you answer is a "no". 
Splunk can NOT handle circular logs.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It depends on how you define "handle".  Splunk expects a file it is monitoring to have new data added to the end.  If the start of the file is overwritten then Splunk assumes the whole file is new and will re-ingest it, resulting in duplicate data.  But the file is still handled!

---
If this reply helps you, Karma would be appreciated.
0 Karma

MuratKuru
Explorer

What I'm taking out of you answer is a "no". 
Splunk can NOT handle circular logs.

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...