What you’re describing is precisely how the [monitor:...] stanza of an inputs.conf works for the Universal Forwarder
from User warren – Stack Overflow https://stackoverflow.com/questions/70588571/can-we-avoid-splunk-indexing-lines-from-a-file-that-gets-overwritten/70594775#70594775
via IFTTT