Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to avoid or minimize duplication of data during the switch of data input of the same data from heavy forwarder to syslogger?

$
0
0
We have our Heavy forwarder server monitoring a shared directory for proxy data log file provided by our proxy team. We want to switch from monitoring a log in a shared directory on Heavy Forwarder to monitoring logs on Syslog server. Right now the data input is running on Heavy Forwarder but we already receiving the same data on our Syslogger server. So we want to disable data input on HF and enable data input on Syslogger How do avoid or minimize duplication of data during the switch of data input of the same data from heavy forwarder to syslogger? We cannot use ignoreOlderThan in inputs.conf because ignoreOlderThan looks at the file's modification timestamp and our logs are getting appended constantly

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>