I'm trying to monitor an xml structured logfile like this:
When a new event is coming in, the new logentry tag is attached one line before the end.
When using monitor://, the logfile is re-read completely and I end up in doubled events for every new line. The message I see in splunkd.log on the forwarder is
Checksum for seekptr didn't match, will re-read entire file file='/logs/example.logs'
Workaround to get rid of the doubled events is to logrotate very often and read the rotated log, not the recent. The rotated log will not be extended so the problem doesn't occur.
Is there better way to monitor the recent log? Tried followTail = 1 , but didn't work out.
Hi @schose, read Lisa's answers please.
View solution in original post