When I start a tail with a simple text search parameter on my log files, a few old log entries are sometimes shown in the result table. I presume the tail function by default also analyzes some of the last lines found in the log files.
Can you please tell me how many last lines are analyzed on tailing?
Can the default number of last lines be changed by the user?
It behaves in the same way as the standard "tail -F" command. If you start a tail you get the "context" of the file defined as the last 8192 bytes. Then you get more data as the file grows. The number of bytes that are prefetched when a tail starts is not configurable from the User Interface.
Since Retrospective release 3.1.0, the number of bytes that are prefetched when a tail starts is configurable within the preferences window.
You can find the option "Tail start offset" on the "Search/Tail(Monitor)" preferences page. In the user manual, it's described as follows.
"Amount of existing data to be delivered when monitoring is started. This value corresponds to the -c option of the Linux tail command. Enter 0 if tailing (monitoring) should start without delivering any existing data."