Same file but different extension

[attgjh1]

Short question.

i have a directory that contains log files that look somethign liek this:

aaa.2012-05-22.log

but the system will compress them up after they go cold i.e.

aaa.2012-05-22.log.gz

in this case, will Splunk detect this new file in the directory that its monitoring and index the file? or would it still ignore it as the exact same log has already been indexed before.

[mikelanghorst · Accepted solution]

The best would be to set your whitelist/blacklists to only grab .log files and ignore .log.gz, that said Splunk should open the file then determine based upon checksums that it's already been read.