Splunk Search

Data index

splunker_123
Path Finder

Hi

I've a question regarding the log file sent by forwarders to indexers

Assume , a log file called abc.log is indexed in the splunk indexer this morning and by afternoon the log is updated,so now ,will the log file will be sent to indexer again by the forwader? OR
only updated portion will be send to the indexer? what is the default nature? If I have to set up spluk in above fashion what will be the configuration I'll have to do please?

Thanks

Tags (1)
0 Karma
1 Solution

dmaislin_splunk
Splunk Employee
Splunk Employee

Just the updated log information is sent.

View solution in original post

dmaislin_splunk
Splunk Employee
Splunk Employee

Just the updated log information is sent.

splunker_123
Path Finder

Thanks..Is this nature by default in splunk? or do we have to tune the configuration to make it happen?

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...