Archive

Data index

Path Finder

Hi

I've a question regarding the log file sent by forwarders to indexers

Assume , a log file called abc.log is indexed in the splunk indexer this morning and by afternoon the log is updated,so now ,will the log file will be sent to indexer again by the forwader? OR
only updated portion will be send to the indexer? what is the default nature? If I have to set up spluk in above fashion what will be the configuration I'll have to do please?

Thanks

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Just the updated log information is sent.

View solution in original post

Splunk Employee
Splunk Employee

Just the updated log information is sent.

View solution in original post

Splunk Employee
Splunk Employee
0 Karma

Path Finder

Thanks..Is this nature by default in splunk? or do we have to tune the configuration to make it happen?

0 Karma