This is a planned feature for the Cisco IOS app. In the meantime you can do the following: On your Cisco device: archive path ftp://USER:PASSWORD@YOUR.FTP.SERVER/cisco_backups/$h write-memory log config logging enable logging size 200 notify syslog contenttype plaintext hidekeys ! An example Splunk input on your forwarder + FTP server: [monitor:///ftproot/cisco_backups/*] sourcetype = Cisco:IOS:Configuration disabled = false Make sure you have the Technology Add-on for Cisco IOS installed on your indexer/forwarder as it defines the Cisco:IOS:Configuration sourcetype stanza. You can then use the built-in Splunk "diff" command to compare two versions ... View more

Note that if another program opens the file without the FILE_SHARE_READ flag, then either splunk will not be able to open the file, or the other program will not be able to open it if Splunk already has it open. ... View more

Correct. It does not work with UDP, since there are no "connections" on a UDP port. However, I am not certain that this would do what you might be thinking it does. Please elaborate on what you would like this setting to actually do. ... View more

This is also why you don't want to have a persistentQueue on any forwarder that's tailing files. The queue will just read in the whole file, which is pointless, since the file itself is its own queue. It can make sense to use a larger and/or persistent queue if your forwarder is collecting only remote information that it can't go get later (e.g., syslog UDP, polling for instantaneous statistics). ... View more