Splunk Search

What if tail -f option is enabled

pramodkumar
Path Finder

Hi,
What specifically the tail -f option do, in which scenario it works perfect.
Please any example would be great..

Tags (1)
0 Karma

pramodkumar
Path Finder

yes am referring to followTail option in inputs.conf

0 Karma

Drainy
Champion

This isn't really a Splunk related question but you're best reading the man pages for tail to learn;

http://unixhelp.ed.ac.uk/CGI/man-cgi?tail

Edit based on comment;

The documentation is pretty clear on its purpose and use, for reference I've pasted it below;

followTail = [0|1]
* WARNING: Use of followTail should be considered an advanced administrative action.
* Treat this setting as an 'action'.  That is, bring splunk up with this
  setting enabled.  Wait enough time for splunk to identify the related files,
  then disable the setting and restart splunk without it.
* DO NOT leave followTail enabled in an ongoing fashion.
* Can be used to force splunk to skip past all current data for a given stanza. 
  * In more detail: this is intended to mean that if you start up splunk with a
    stanza configured this way, all data in the file at the time it is first
    encountered will not be read.  Only data arriving after that first
    encounter time will be read.
  * This can be used to "skip over" data from old log files, or old portions of
    log files, to get started on current data right away.
* If set to 1, monitoring begins at the end of the file (like tail -f).
* If set to 0, Splunk will always start at the beginning of the file. 
* Defaults to 0.

http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf

0 Karma

pramodkumar
Path Finder

does it mean, only the new events added to the file those events will be picked, rest will be skipped off.. if its like that then my requirement is sufficed..

0 Karma

roychen
Path Finder

Hi,

I'm afraid your question is not very specific. Do you mean the followTail option in inputs.conf, or something else?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...