Splunk Search

What if tail -f option is enabled

pramodkumar
Path Finder

Hi,
What specifically the tail -f option do, in which scenario it works perfect.
Please any example would be great..

Tags (1)
0 Karma

pramodkumar
Path Finder

yes am referring to followTail option in inputs.conf

0 Karma

Drainy
Champion

This isn't really a Splunk related question but you're best reading the man pages for tail to learn;

http://unixhelp.ed.ac.uk/CGI/man-cgi?tail

Edit based on comment;

The documentation is pretty clear on its purpose and use, for reference I've pasted it below;

followTail = [0|1]
* WARNING: Use of followTail should be considered an advanced administrative action.
* Treat this setting as an 'action'.  That is, bring splunk up with this
  setting enabled.  Wait enough time for splunk to identify the related files,
  then disable the setting and restart splunk without it.
* DO NOT leave followTail enabled in an ongoing fashion.
* Can be used to force splunk to skip past all current data for a given stanza. 
  * In more detail: this is intended to mean that if you start up splunk with a
    stanza configured this way, all data in the file at the time it is first
    encountered will not be read.  Only data arriving after that first
    encounter time will be read.
  * This can be used to "skip over" data from old log files, or old portions of
    log files, to get started on current data right away.
* If set to 1, monitoring begins at the end of the file (like tail -f).
* If set to 0, Splunk will always start at the beginning of the file. 
* Defaults to 0.

http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf

0 Karma

pramodkumar
Path Finder

does it mean, only the new events added to the file those events will be picked, rest will be skipped off.. if its like that then my requirement is sufficed..

0 Karma

roychen
Path Finder

Hi,

I'm afraid your question is not very specific. Do you mean the followTail option in inputs.conf, or something else?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...