Data index

[splunker_123]

Hi

I've a question regarding the log file sent by forwarders to indexers

Assume , a log file called abc.log is indexed in the splunk indexer this morning and by afternoon the log is updated,so now ,will the log file will be sent to indexer again by the forwader? OR
only updated portion will be send to the indexer? what is the default nature? If I have to set up spluk in above fashion what will be the configuration I'll have to do please?

Thanks

[dmaislin_splunk · Accepted solution]

Just the updated log information is sent.

[dmaislin_splunk]

Yes. This is the default behavior.

http://docs.splunk.com/Documentation/Splunk/4.3.2/Admin/Inputsconf

http://docs.splunk.com/Documentation/Splunk/4.3.2/Admin/Howindexingworks

[splunker_123]

Thanks..Is this nature by default in splunk? or do we have to tune the configuration to make it happen?