Splunk Search

Data index

splunker_123
Path Finder

Hi

I've a question regarding the log file sent by forwarders to indexers

Assume , a log file called abc.log is indexed in the splunk indexer this morning and by afternoon the log is updated,so now ,will the log file will be sent to indexer again by the forwader? OR
only updated portion will be send to the indexer? what is the default nature? If I have to set up spluk in above fashion what will be the configuration I'll have to do please?

Thanks

Tags (1)
0 Karma
1 Solution

dmaislin_splunk
Splunk Employee
Splunk Employee

Just the updated log information is sent.

View solution in original post

dmaislin_splunk
Splunk Employee
Splunk Employee

Just the updated log information is sent.

splunker_123
Path Finder

Thanks..Is this nature by default in splunk? or do we have to tune the configuration to make it happen?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...