Handle log rolling and index today's log file and yesterday's log file

[samitroy]

we have a scenario where we roll logs everyday. we want splunk to index log file for today and log file for yesterday. because our application server keeps logging to both today's log file and yesterday's log file. No need to index on the log file which got generated the day before yesterday. How can we achieve this ?

[kristian_kolb]

Normally it's enough to monitor the directory in which the files are created. Splunk will detect that the files are being updated, and index the new events. Start by reading through these sections of the docs.

http://docs.splunk.com/Documentation/Splunk/latest/Tutorial/WelcometotheSplunkTutorial
http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor