Monitoring Splunk

Monitoring file without timestamp

habbash
Loves-to-Learn

Hi Splunker;

I have file without timestamp, and Splunk monitoring this file, once any new logs coming to this file, Splunk read all the logs in this file (old and new logs), so how I can to do configuration to Splunk read only the new logs coming to the file.

 

Please help me.

 

Best Regards; 

Labels (1)
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.