Why does the .etl file stop receiving any new events on Windows 2012 Server on Splunk and is there another way to deliver DNS logs to Splunk?

[lightech1]

Hello everyone,

We have a universal forwarder installed on the Windows 2012 machine and we use the addons and PowerShell script to transmit the analytical DNS logs to Splunk, also we have followed this article from Microsoft:

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn...

The problem is when the file .etl arrived at the limit manually configured (Example 500 MB), it stops delivering the logs to Splunk because it neither overwrite events on the file (configuration Microsoft Article) nor the file rotates to start a new one, so the .etl file does not receive any new event.

The questions:

Is there any another way to deliver the DNS logs to Splunk (without using the stream app)?
Has anybody had this problem with the.ETL file?

Thanks in advance.