topic Re: Splunk input offset in Getting Data In

How can I resolve Splunk input offset?

joe06031990 — Mon, 15 May 2023 14:40:09 GMT

Hi,

I am onboarding the /var/log/secure path and i am getting the bellow about offset

INFO WatchedFile

/path/to/file.log

Will begin reading at offset=253 for file

Just wondered what I could do to resolve this?

Thanks,

Joe

Re: Splunk input offset

richgalloway — Fri, 12 May 2023 16:42:15 GMT

There is nothing you need to do. The message is informational and is just Splunk telling you what it is doing.

Re: Splunk input offset

joe06031990 — Fri, 12 May 2023 16:57:25 GMT

Hi, I have two servers with identical server classes and apps one has onboard /var/log/secure and one has not, the one that has not has that message about the offset but the one which has doesn't have the offset message.