All Apps and Add-ons

Can Splunk 8.1.3 handle circular log?

MuratKuru
Explorer

Splunk Enterprise
Version:8.1.3

Hi All
Can Splunk Enterprise Version:8.1.3 handle circular log?

 

Labels (1)
Tags (1)
0 Karma
1 Solution

MuratKuru
Explorer

What I'm taking out of you answer is a "no". 
Splunk can NOT handle circular logs.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It depends on how you define "handle".  Splunk expects a file it is monitoring to have new data added to the end.  If the start of the file is overwritten then Splunk assumes the whole file is new and will re-ingest it, resulting in duplicate data.  But the file is still handled!

---
If this reply helps you, Karma would be appreciated.
0 Karma

MuratKuru
Explorer

What I'm taking out of you answer is a "no". 
Splunk can NOT handle circular logs.

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...