log file rotation

[rupesh212121]

When splunk is watching a directory for log files will it reindex a file that gets rotated? I am trying to make sure that some of my logs are not getting indexed twice.

Example:

file1.log gets changed to file1.log12212010 service creates new file1.log and continues logging

where can i save the rotated log file or does splunk have any facility to save the rotated logs. please answer. thank u rupesh.

[Ayn]

No, Splunk has a number of ways of recognizing the file's content other than the actual filename so it will not reindex a file just because the name changed.

As for the second question I'm not sure what you mean - Splunk itself has no functionality (to my knowledge) for rotating, moving or otherwise modify the log files. All it does is index the data contained in the log files to its own database.