I need to know if a universal forwarder could send only the delta changes in a log or need to forward the hole log to the splunk instance.
As I answered you in a similar question, the forwarder will keep track on the how far into a file it has read, so that it can determine which events have been added since it last looked.
It will also be able to determine if a filed has been rotated, though in some circumstances you will have to make a few configuration changes to make the forwarder understand that it's looking at a new file.
See the "Getting Data In" section in the docs.
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Monitorfilesanddirectories
http://docs.splunk.com/Documentation/Splunk/latest/Data/Howlogfilerotationishandled
Hope this helps,
Kristian
It's the only behaviour - I don't understand how else it would work.
Thanks, So sending the delta is the default behavior?
As I answered you in a similar question, the forwarder will keep track on the how far into a file it has read, so that it can determine which events have been added since it last looked.
It will also be able to determine if a filed has been rotated, though in some circumstances you will have to make a few configuration changes to make the forwarder understand that it's looking at a new file.
See the "Getting Data In" section in the docs.
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Monitorfilesanddirectories
http://docs.splunk.com/Documentation/Splunk/latest/Data/Howlogfilerotationishandled
Hope this helps,
Kristian
I think you need to clarify what your definition of those two cases are. Send only the delta when? Send the whole log when? Forwarders obviously will not send the whole log file each and every time an event is added to it.