Splunk Search

What if tail -f option is enabled

Path Finder

What specifically the tail -f option do, in which scenario it works perfect.
Please any example would be great..

Tags (1)
0 Karma

Path Finder

yes am referring to followTail option in inputs.conf

0 Karma


This isn't really a Splunk related question but you're best reading the man pages for tail to learn;


Edit based on comment;

The documentation is pretty clear on its purpose and use, for reference I've pasted it below;

followTail = [0|1]
* WARNING: Use of followTail should be considered an advanced administrative action.
* Treat this setting as an 'action'.  That is, bring splunk up with this
  setting enabled.  Wait enough time for splunk to identify the related files,
  then disable the setting and restart splunk without it.
* DO NOT leave followTail enabled in an ongoing fashion.
* Can be used to force splunk to skip past all current data for a given stanza. 
  * In more detail: this is intended to mean that if you start up splunk with a
    stanza configured this way, all data in the file at the time it is first
    encountered will not be read.  Only data arriving after that first
    encounter time will be read.
  * This can be used to "skip over" data from old log files, or old portions of
    log files, to get started on current data right away.
* If set to 1, monitoring begins at the end of the file (like tail -f).
* If set to 0, Splunk will always start at the beginning of the file. 
* Defaults to 0.


0 Karma

Path Finder

does it mean, only the new events added to the file those events will be picked, rest will be skipped off.. if its like that then my requirement is sufficed..

0 Karma

Path Finder


I'm afraid your question is not very specific. Do you mean the followTail option in inputs.conf, or something else?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!