Why does Splunk stop indexing logs on daily basis?

prateeksawhney — Wed, 15 Jun 2022 18:06:11 GMT

Hi All,

I need your urgent help in fixing one of the issue in my PROD environment.

we have an application log which rotates twice daily. once in the afternoon and once around midnight. Logs starts feeding in splunk when log rotates around afternoon and stops feeding when log rotates around midnight.

if we do some minor changes to inputs like adding any extra parameter to inputs.conf if starts feeding again and then stops again in few seconds.

This is my inputs.conf

[monitor:///var/log/logpath/logpath/xx*.log]
sourcetype = abcd
disabled = false
index = xyz

this is my props.conf

[abcd]
SHOULD_LINEMERGE=TRUE
BREAK_ONLY_BEFORE = \w\|\d+\|\d{2}:\d{2}:\d{2}\.\d{6}
MAX_TIMESTAMP_LOOKAHEAD = 15
NO_BINARY_CHECK = true
TIME_FORMAT = %H:%M:%S.%6N
TIME_PREFIX = \w.*\|\d*\|
category = Custom
disabled = false
pulldown_type = true
TRUNCATE=50000
MAX_EVENTS = 9999

Please let me know if any other information is required here. Any help here will be highly appreciated.

Thanks in advance

Prateek

Re: Splunk stops indexing logs on daily basis

gcusello — Wed, 15 Jun 2022 08:05:29 GMT

hi @prateeksawhney,

which are the names of the log files before and after rotation?

Ciao.

Giuseppe

Re: Splunk stops indexing logs on daily basis

prateeksawhney — Wed, 15 Jun 2022 08:27:29 GMT

XXX++-461-20211001-165550.log
XXX++-461-20211006-170000.log
XXX++-56551-20211210-113917.log
XXX++-61336-20220118-071748.log

This is the name of the logfile, logfile name keeps on changing everytime logfile rotates.

topic Re: Splunk stops indexing logs on daily basis in Getting Data In

Why does Splunk stop indexing logs on daily basis?

Re: Splunk stops indexing logs on daily basis

Re: Splunk stops indexing logs on daily basis