Getting Data In

Reset splunk forwarder to read a file from a particular offset

raknair07
Engager

Using btprobe with --reset causes the splunk forwarder to re-read the entire file. However i want the forwarder to read only from a particular offset, and not necessarily from the beginning of the file. Can i do that? Is there a way i can set the "sptr" attribute associated with each file, to a particular value.

dwaddle
SplunkTrust
SplunkTrust

I would say there is no supported way to do this using the btprobe command. The btprobe tool itself is only barely supported - falling into the category of "Command Line Tools for Use with Support." Further, the documentation on btprobe does not discuss any way of accomplishing anything other than a 'full reset'.

0 Karma

Lowell
Super Champion

I think the answer is no. Added an upvote because I'd like an authoritative answer to this as well.

MuS
SplunkTrust
SplunkTrust

nice one - up voted as well

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...