Are there any resources that explain in detail how Splunk works to monitor files on a universal forwarder?

[jldebell]

I am trying to find a resource that explains how Splunk works to monitor files. I am familiar with the set up of inputs.conf files and from the Splunk Server side, but I am not familiar with the side that has a Universal Forwarder installed. My understanding is a file/log path is set up so the server produces logs and Splunk will then look for the files. Here are some of the questions I receive:

How long should we maintain the logs in the directory to be monitored?
If the log file is reaching the size limit, will a new file will be created?

Will Splunk capture the old information and the new information without losing data?
How quickly will Splunk capture the information and index it?

Basically, any information related to the universal forwarder server side. Information that describes what the users wanting to have logs collected from Splunk should do and how the process will work from their end.

Thanks for your assistance.

Jenn

[kml_uvce · Accepted solution]

How long should we maintain the logs in the directory to be monitored?
If the log file is reaching the size limit, will a new file will be created?
its upto you, for example you can maintain for 1 day and new file will be generated after 1 day.
Will Splunk capture the old information and the new information without losing data?
yes
How quickly will Splunk capture the information and index it?
as soon as splunk forwarder process reads data from file and sends to indexer , actually it will not take much time and can be in real time if everything works fine like network latency , buffering etc
http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/inputsconf

[jldebell]

Thanks for the information regarding the inputs.conf files. I was coming up with the same resource, but I was looking more specifically for the answers to the questions. Are these documented as part of the process? Thank you for your assistance.

[jldebell]

Here is the information I was looking for.

http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Monitorfilesanddirectories

Thanks again for your assistance!