Hi,
After reading:
- https://answers.splunk.com/answers/49663/log-rotation-best-practices.html
- https://answers.splunk.com/answers/436074/why-does-data-stop-getting-indexed-after-a-log-rot.html
I'm bit puzzled what is the best practice way:
- to get most real time data in
- not to lose any data during rotations
And how should Splunk be set to monitor rotated paths of the files (e.g. set to monitor also compressed paths of the rotated files or to exclude them from the monitors). So that also most part of the edge cases would have been covered:
- e.g. maybe splunk forwarder is not running in some point in time
- e.g. maybe splunk forwarder is not able to send data to Indexers at point in time
- e.g. maybe remnants of the data is written by application to the rotated file.
If I want both. To get the most real time data in and not to lose any data.
Should I rename-and-recreate or to copy-truncate?
Should I set Splunk to also monitor rotated and compressed paths? Even if there is "months" of compressed log files in path..
