Splunk forwarder - When the log file will be send to splunk indexer ?

[clementros]

Hi,

I'm currently monitoring log files on unix server. Jobs application write log file in a directory.
I want to monitor only log file that is finished to be write. How i can do that ?

I don't want splunk to compare the beginning of the file to know if a file was already send to the indexer because if new lines are added to this file the forwarder will not see it.

If the forwarder compare last lines to see if a file is new, it will sent the same file multiple time rights ?

Can you help me please ?

[richgalloway · Accepted solution]

By default, forwarders read new lines from monitored files and send only the new data to indexers.

[clementros]

Thank you