I have one query with regards to Log Monitoring
Let's say I want to monitor abc.log and the last Updated date of the Log File is Aug 2022 or Sep 2022 and I install the UF in the Log server in Feb 2023 and create inputs monitoring for abc.log
Does splunk monitor the old data which is already there in the Log file from Aug or Sep 2022 and show the Logs in Splunk?
in general it's possible, it depends on two factors:
The first condition is obvious.
The second condition is the default in log acquisision, but you could also put limits for old logs.
Obviously, you have to put them in an index with a retention greater than six months otherwise logs will be deleted few time after indexing.
Splunk can read all logs, stored in text files, even if of many months ago assigning to them the correct timestamp.
About the second condition: in Splunk inputs you can define a limit in the past to avoid to index too old logs, (e.g. index logs not older than 2 days) but by default there isn't any limit.