Deployment Architecture

current_only=1 for /var/log/messages


I noticed we can enabled the 'current_only' feature for Windows event logs, Does the UF for *NIX support the same type of functionality?

Thank you!

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

I do not recommend followTail, the followTail is only useful to index a file that will not rotate (using same filename).

If your use case is to index recents events ( disregarding old historical log files)
you can use the ignore_older_than option, it disregard files that have a modification time older than the value.
So It will still index the totality of the recent files, but reduce initial volume to index.

Or simply rotate your logs and move the old files out of the folder before enabling the inputs.

Ultra Champion

true, thus the link to the article saying so. 🙂

0 Karma

Ultra Champion


It's called followTail, but you should probably read this first:


0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...