Can you expand on your rsyslog configuration a little bit? My rsyslog creates a directory hierarchy based upon the source IP address for the log message, then creates a new log file per day for each unique IP address.
If you need to replace Server A with Server B on a scheduled date and time you may want to move the older data out of "view" of splunk monitored directories just before you fire up Splunk on Server B, then you can shutdown Splunk on Server A. At that point the log data will be ingested via Server B, and once you are satisfied you are getting all the required logs you can decommission Server A. If things appear to be going left you can always turn Splunk back on server A and it will pickup logs from where it left off.
... View more