Getting Data In

Universal forwarder monitor clean files

JohnTelus
New Member

In monitoring a file, it can get very large as the application creating the syslogs adds to it. The there any facility that the universal forwarder has that can provide some assistance in cleaning out events that have been delivered to the indexer.

Tags (1)
0 Karma

bosburn_splunk
Splunk Employee
Splunk Employee

As of right now, there is no facility that accomplishes this goal. You could write a script to rotate the log files outside of Splunk.

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...