https://community.splunk.com/t5/Getting-Data-In/Analyzing-Splunk-Internal-Logs-What-is-Tailing-Processor-and/m-p/635917#M108790 <P>These two components help with the handling of <FONT face="courier new,courier">monitor://</FONT> inputs.&nbsp; <FONT face="courier new,courier">WatchedFile</FONT> detects when the file changes and <FONT face="courier new,courier">TailingProcessor</FONT> reads the new data.&nbsp; The first message says the component will detect changes using the file modification time.&nbsp; The second message says it's asked <FONT face="courier new,courier">WatchedFile</FONT> to keep an eye on the specified file path.</P> Fri, 24 Mar 2023 12:44:28 GMT richgalloway 2023-03-24T12:44:28Z https://community.splunk.com/t5/Getting-Data-In/Analyzing-Splunk-Internal-Logs-What-is-Tailing-Processor-and/m-p/635904#M108786 <P>Hi Everyone,</P> <P>&nbsp;</P> <P>I recently observed the splunk internal logs and found that there is a field component and found two values for component field -</P> <P>1<STRONG>.<A href="https://es-starsiem.splunkcloud.com/en-US/app/search/search?q=search%20index%3D_internal%20%2Fvar%2Flib%2Fdocker%2Fcontainers%20%20NOT%20StreamedSearch&amp;earliest=-7d%40h&amp;latest=now&amp;display.page.search.mode=verbose&amp;dispatch.sample_ratio=1&amp;workload_pool=standard_perf&amp;display.page.search.tab=events&amp;display.general.type=events&amp;display.prefs.fieldFilter=src_&amp;display.events.fields=%5B%22host%22%2C%22source%22%2C%22sourcetype%22%2C%22index%22%2C%22severity%22%2C%22event.Technique%22%2C%22EventID%22%2C%22direction%22%2C%22destinationPort%22%2C%22sourcePort%22%2C%22transport%22%2C%22service%22%2C%22message%22%2C%22user%22%2C%22userIdentity.arn%22%2C%22source_type%22%2C%22signature%22%2C%22LogonError%22%2C%22status_label%22%2C%22Total_Mb%22%2C%22fsize%22%2C%22total%22%2C%22Total1%22%2C%22userPrincipalName%22%2C%22ErrorNumber%22%2C%22dest_ip%22%2C%22file_size%22%2C%22eventName%22%2C%22Source_Workstation%22%2C%22WorkstationName%22%2C%22Workstation%22%2C%22dest%22%2C%22resources%7B%7D.ARN%22%2C%22httpRequest.uri%22%2C%22httpRequest.args%22%2C%22httpRequest.httpMethod%22%2C%22httpRequest.clientIp%22%2C%22userIdentity.principalId%22%2C%22httpRequest.headers%7B%7D.name%22%2C%22httpRequest.headers%7B%7D.value%22%2C%22file_hash%22%2C%22event.PatternDispositionDescription%22%2C%22event_desc%22%2C%22rule_name%22%2C%22notable_xref_id%22%2C%22errorMessage%22%2C%22status%22%2C%22event.PatternDispositionFlags.QuarantineFile%22%2C%22subject%22%2C%22event.LocalIP%22%2C%22event.UserName%22%2C%22src_user%22%2C%22file_name%22%2C%22SubjectUserName%22%2C%22TargetUserName%22%2C%22Target_User_Name%22%2C%22comment%22%2C%22Host%22%2C%22httpRequest.country%22%2C%22Website%22%2C%22ClientIp%22%2C%22eventSource%22%2C%22action%22%2C%22user_type%22%2C%22errorCode%22%2C%22Region%22%2C%22requestParameters.userName%22%2C%22IamUser%22%2C%22RequestUsername%22%2C%22webaclId%22%2C%22acl%22%2C%22userIdentity.userName%22%2C%22disposition_label%22%2C%22source_ip%22%2C%22src%22%2C%22dst%22%2C%22ServerIPAddress%22%2C%22Hash%22%2C%22md5%22%2C%22sha2%22%2C%22file_hash2%22%2C%22parent_file_sha2%22%2C%22Risk%20name%22%2C%22file_path%22%2C%22true_file_path%22%2C%22dmac%22%2C%22RequestUID%22%2C%22Requestid%22%2C%22Computer_Name%22%2C%22Computer_dest%22%2C%22event.ComputerName%22%2C%22Host_Name%22%2C%22ip%22%5D&amp;sid=1679657469.108697#" target="_blank" rel="noopener">TailingProcesso</A>r</STRONG></P> <P><STRONG>2.Watched file</STRONG></P> <P><SPAN class="">INFO</SPAN> <SPAN class="">WatchedFile</SPAN><SPAN> [</SPAN><SPAN class="">3338437</SPAN> <SPAN class="">tailreader0</SPAN><SPAN>] </SPAN><SPAN class="">-</SPAN> <SPAN class="">Will</SPAN> <SPAN class="">use</SPAN> <SPAN class="">tracking</SPAN> <SPAN class="">rule=modtime</SPAN> <SPAN class="">for</SPAN> <SPAN class="">file=</SPAN><SPAN>'</SPAN><SPAN class=""><SPAN class="">/path/.conf</SPAN></SPAN></P> <P><SPAN class=""><SPAN class="">INFO TailingProcessor<SPAN> [</SPAN>3338433 MainTailingThread<SPAN>] </SPAN>- Adding watch on path: /path</SPAN></SPAN></P> <P>Please help me understand what these logs says about.</P> <P>Thanks&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> Fri, 24 Mar 2023 19:41:22 GMT https://community.splunk.com/t5/Getting-Data-In/Analyzing-Splunk-Internal-Logs-What-is-Tailing-Processor-and/m-p/635904#M108786 umesh 2023-03-24T19:41:22Z https://community.splunk.com/t5/Getting-Data-In/Analyzing-Splunk-Internal-Logs-What-is-Tailing-Processor-and/m-p/635917#M108790 <P>These two components help with the handling of <FONT face="courier new,courier">monitor://</FONT> inputs.&nbsp; <FONT face="courier new,courier">WatchedFile</FONT> detects when the file changes and <FONT face="courier new,courier">TailingProcessor</FONT> reads the new data.&nbsp; The first message says the component will detect changes using the file modification time.&nbsp; The second message says it's asked <FONT face="courier new,courier">WatchedFile</FONT> to keep an eye on the specified file path.</P> Fri, 24 Mar 2023 12:44:28 GMT https://community.splunk.com/t5/Getting-Data-In/Analyzing-Splunk-Internal-Logs-What-is-Tailing-Processor-and/m-p/635917#M108790 richgalloway 2023-03-24T12:44:28Z