Monitoring Splunk

Monitoring file without timestamp

habbash
Loves-to-Learn

Hi Splunker;

I have file without timestamp, and Splunk monitoring this file, once any new logs coming to this file, Splunk read all the logs in this file (old and new logs), so how I can to do configuration to Splunk read only the new logs coming to the file.

 

Please help me.

 

Best Regards; 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...