Monitoring Log File provided as - Days of Week and Hourly

[pjohnson1]

We are provided a certain type of log in the following format:

App-Hourly.log
App-Mon.log
App-Tue.log
App-Wed.log
App-Thur.log
App-Fri.log
App-Sat.log
App-Sun.log

The 'Hourly' log is rotated hourly and 'Days of the Week' are rotated daily.

What would be the best way to feed these logs into Splunk from the Forwarder without duplicating events?

[martin_mueller]

So... each event is written once to App-Hourly.log and once to App-$weekday$.log?

I'd monitor all seven Day-of-Week files from the forwarder and have the app people disable the duplicate hourly log entirely.