What if tail -f option is enabled

[pramodkumar]

Hi,
What specifically the tail -f option do, in which scenario it works perfect.
Please any example would be great..

[pramodkumar]

yes am referring to followTail option in inputs.conf

[Drainy]

This isn't really a Splunk related question but you're best reading the man pages for tail to learn;

http://unixhelp.ed.ac.uk/CGI/man-cgi?tail

Edit based on comment;

The documentation is pretty clear on its purpose and use, for reference I've pasted it below;

followTail = [0|1]
* WARNING: Use of followTail should be considered an advanced administrative action.
* Treat this setting as an 'action'.  That is, bring splunk up with this
  setting enabled.  Wait enough time for splunk to identify the related files,
  then disable the setting and restart splunk without it.
* DO NOT leave followTail enabled in an ongoing fashion.
* Can be used to force splunk to skip past all current data for a given stanza. 
  * In more detail: this is intended to mean that if you start up splunk with a
    stanza configured this way, all data in the file at the time it is first
    encountered will not be read.  Only data arriving after that first
    encounter time will be read.
  * This can be used to "skip over" data from old log files, or old portions of
    log files, to get started on current data right away.
* If set to 1, monitoring begins at the end of the file (like tail -f).
* If set to 0, Splunk will always start at the beginning of the file. 
* Defaults to 0.

http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf

[pramodkumar]

does it mean, only the new events added to the file those events will be picked, rest will be skipped off.. if its like that then my requirement is sufficed..

[roychen]

Hi,

I'm afraid your question is not very specific. Do you mean the followTail option in inputs.conf, or something else?