Hi,
I have a doubt about logs uploading data. Like I have installed Splunk forwarder on a server. In mid-night to avoid license violation if I stopped forwarder on the server and in next morning around 6 am once I will again restarted it so does forwarder send the logs for that time period as well during which it was stopped.
Thanks
Sunny
You can use ignoreOlderThan = 0d
on the forwarder's inputs.conf. And right, it will index all applicable logs.
How to make a forwarder ignore logs other than today's -- ignoreOlderThan question
Yes. It picks up wherever it left off with the pedal to the metal.
thanks buddy..
You can use ignoreOlderThan = 0d
on the forwarder's inputs.conf. And right, it will index all applicable logs.
How to make a forwarder ignore logs other than today's -- ignoreOlderThan question
Hi,
But in my default input.conf file the parameter you have mentioned is not included so what happened when next day i will start forwarder? Does it uploaded the logs of that time period during which it was stopped?
Thanks
Sunny
It should. It's all based on the timestamps of the log files and not on the period on which the forwarder was up or down.
thanks a lot for your answer..