Deployment Architecture

current_only=1 for /var/log/messages

bigtyma
Communicator

I noticed we can enabled the 'current_only' feature for Windows event logs, Does the UF for *NIX support the same type of functionality?

Thank you!

Tags (2)
0 Karma

yannK
Splunk Employee
Splunk Employee

I do not recommend followTail, the followTail is only useful to index a file that will not rotate (using same filename).

If your use case is to index recents events ( disregarding old historical log files)
you can use the ignore_older_than option, it disregard files that have a modification time older than the value.
So It will still index the totality of the recent files, but reduce initial volume to index.

Or simply rotate your logs and move the old files out of the folder before enabling the inputs.

kristian_kolb
Ultra Champion

true, thus the link to the article saying so. 🙂

0 Karma

kristian_kolb
Ultra Champion

Yes.

It's called followTail, but you should probably read this first:

http://answers.splunk.com/answers/57819/when-is-it-appropriate-to-set-followtail-to-true

/K

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!