In monitoring a file, it can get very large as the application creating the syslogs adds to it. The there any facility that the universal forwarder has that can provide some assistance in cleaning out events that have been delivered to the indexer.
As of right now, there is no facility that accomplishes this goal. You could write a script to rotate the log files outside of Splunk.
