Is there a way to delete old log file in UF before start re-ingestion?

[chandana204]

Hi, This is same scenario as my last question. I am getting data from a server where i have installed my UF. every night at 12 AM log file will generate with the date as mylog_yesterday_date.log. Sometimes i reboot the server, after rebooting the server, it's collecting all data from the shut down time.

Let's say I have shut down my server yesterday at 4:00 PM and rebooted today at 1:00 PM. After reboot the server it is collecting all data from shut down time (yesterday 4:00 PM) until reboot time (today 1:00 PM) and will continue gather data in real-time, this is happening in the server. When it's come to log creation, yesterday mid night log created as mylog_yesertday_date.log but the file has data until 4:00 PM because it has gathered until that time. This file is forwarding to Splunk. After rebooting server, it has full day data. Before i add this data to UF, currently i am deleting yesteday's half data and starting re-ingestion. Likewise I am getting data without data loss.

My question is, is there any way to delete the yesterday's half file data from UF automatically by comparing yesterday's log file last timestamp with the time 11:59 PM by writing scripts before start re-ingestion process? If so please let me know.

Thanks,
Chandana

[sudosplunk]

Does your inputs.conf have a setting crcSalt = <SOURCE>? Can you paste your inputs.conf

[richgalloway]

The UF keeps track of its position within the files it is monitoring and will resume where it left off following a reboot of the server or a restart of the UF. You shouldn't need to delete any data yourself.