Getting Data In

Reset splunk forwarder to read a file from a particular offset

raknair07
Engager

Using btprobe with --reset causes the splunk forwarder to re-read the entire file. However i want the forwarder to read only from a particular offset, and not necessarily from the beginning of the file. Can i do that? Is there a way i can set the "sptr" attribute associated with each file, to a particular value.

dwaddle
SplunkTrust
SplunkTrust

I would say there is no supported way to do this using the btprobe command. The btprobe tool itself is only barely supported - falling into the category of "Command Line Tools for Use with Support." Further, the documentation on btprobe does not discuss any way of accomplishing anything other than a 'full reset'.

0 Karma

Lowell
Super Champion

I think the answer is no. Added an upvote because I'd like an authoritative answer to this as well.

MuS
Legend

nice one - up voted as well

Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...