Files can't be ingested while being in transit via ftp

danielbb — Wed, 20 Oct 2021 19:59:13 GMT

The case at https://community.splunk.com/t5/Getting-Data-In/Issue-on-file-monitoring-using-forwader/m-p/478063#M82045 is similar.

When files are being ftp'ed to the location we see in _internal errors that the file can't be read. Comes the weekend and this host is being rebooted and the files are being ingested.

We looked at MonitorNoHandle that allows reading while the file is being written on Windows but MonitorNoHandle only allows one such file per stanza.

We asked the customer to ftp the files to another directory and move them later via a script but the customer wasn't thrilled about this idea.

We also thought that maybe there is a way to have the UF check for new files multiple times before putting them in the black list and it doesn't seem to be possible.

What can we do?

topic Files can't be ingested while being in transit via ftp in Getting Data In

Files can't be ingested while being in transit via ftp