current_only=1 for /var/log/messages

[bigtyma]

I noticed we can enabled the 'current_only' feature for Windows event logs, Does the UF for *NIX support the same type of functionality?

Thank you!

[yannK]

I do not recommend followTail, the followTail is only useful to index a file that will not rotate (using same filename).

If your use case is to index recents events ( disregarding old historical log files)
you can use the ignore_older_than option, it disregard files that have a modification time older than the value.
So It will still index the totality of the recent files, but reduce initial volume to index.

Or simply rotate your logs and move the old files out of the folder before enabling the inputs.

[kristian_kolb]

true, thus the link to the article saying so. 🙂

[kristian_kolb]

Yes.

It's called followTail, but you should probably read this first:

http://answers.splunk.com/answers/57819/when-is-it-appropriate-to-set-followtail-to-true

/K