monitor latest file only

[katalinali]

I write a script to blacklist the oldest file but splunk don't reload inputs.conf until someone restart the services but it is not acceptable in my case. Do there are any options that control splunk to monitor only latest file or some rule like abandon oldest file when I need to monitor a folder that contains over thousands of file.

[ziegfried]

The easiest way would be to monitor a separate folder and let the script place a symlink for the latest file there.

[katalinali]

It is windows platform and I don't have the right to control where the file should be placed. It may not work for me

[dwaddle]

The main caveat being sure you know when the latest file is 'done' and splunk has completely indexed it before redoing the symlink. Perhaps a good compromise might be to keep a symlink to the most current log and the one most-previous log. That way, Splunk can still have access to the prior 'latest' file right around the time of switchover.