saving log rotated files in splunk

[rupesh212121]

Thanks david for the link. but i wanted to know if someday later if i want to view the log rotated file thn how can i view it. is there any mechanism that this log rotated data can be stored anywhere in splunk for future view or splunk maitains some history anywhere.

[David]

Hello,

I'm not entirely clear on what your use case is. What problem are you looking to solve, by looking at a particular rotated file?

Splunk does not rotate files itself, and it doesn't really concern itself with when or if a file is rotated (except in making sure it doesn't re-index a file). Suppose you had a rotation schedule set to turn over every day, Splunk would just monitor the current file, and when it's rotated start reading the new file. If you wanted to look at data that was produced yesterday (e.g., data in the file that was later rotated), you can just run a search for "earliest=-1d@d latest=@d". (See: Changing Time Range).

Let me know if that's not clear, or doesn't solve your particular problem.

[pranavrao]

Where do you set the rotation schedule?