Using btprobe with --reset causes the splunk forwarder to re-read the entire file. However i want the forwarder to read only from a particular offset, and not necessarily from the beginning of the file. Can i do that? Is there a way i can set the "sptr" attribute associated with each file, to a particular value.
I would say there is no supported way to do this using the btprobe
command. The btprobe
tool itself is only barely supported - falling into the category of "Command Line Tools for Use with Support." Further, the documentation on btprobe
does not discuss any way of accomplishing anything other than a 'full reset'.
I think the answer is no. Added an upvote because I'd like an authoritative answer to this as well.
nice one - up voted as well