https://community.splunk.com/t5/Getting-Data-In/TailReader-TailReader-260668-tailreader0-Batch-input-finished/m-p/695694#M115490 <P>HI&nbsp;<BR />in splunkd.log file I am seeing:</P><P>TailReader [260668 tailreader0] - Batch input finished reading file='/opt/splunkforwarder/var/spool/splunk/tracker.log'<BR /><BR />and In splunk, I am seeing the logs as well</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="raiqb01_0-1723119942777.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32113iCBCAF34F8527B62B/image-size/medium?v=v2&amp;px=400" role="button" title="raiqb01_0-1723119942777.png" alt="raiqb01_0-1723119942777.png" /></span></P><P>Basically, I want to know that is happening here.</P><P>this tracker.log file should be under index=_internal but somehow this file is present under index=linux&nbsp; and in Linux TA, I can see the [linux_audit] sourcetype config under props.conf.&nbsp;<BR />who is calling this as I am not seeing any related input parameter for this.</P><P>Kind Regards,</P><P>Rashid</P><P>&nbsp;</P><P>&nbsp;</P> Thu, 08 Aug 2024 12:44:27 GMT raiqb01 2024-08-08T12:44:27Z https://community.splunk.com/t5/Getting-Data-In/TailReader-TailReader-260668-tailreader0-Batch-input-finished/m-p/695694#M115490 <P>HI&nbsp;<BR />in splunkd.log file I am seeing:</P><P>TailReader [260668 tailreader0] - Batch input finished reading file='/opt/splunkforwarder/var/spool/splunk/tracker.log'<BR /><BR />and In splunk, I am seeing the logs as well</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="raiqb01_0-1723119942777.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32113iCBCAF34F8527B62B/image-size/medium?v=v2&amp;px=400" role="button" title="raiqb01_0-1723119942777.png" alt="raiqb01_0-1723119942777.png" /></span></P><P>Basically, I want to know that is happening here.</P><P>this tracker.log file should be under index=_internal but somehow this file is present under index=linux&nbsp; and in Linux TA, I can see the [linux_audit] sourcetype config under props.conf.&nbsp;<BR />who is calling this as I am not seeing any related input parameter for this.</P><P>Kind Regards,</P><P>Rashid</P><P>&nbsp;</P><P>&nbsp;</P> Thu, 08 Aug 2024 12:44:27 GMT https://community.splunk.com/t5/Getting-Data-In/TailReader-TailReader-260668-tailreader0-Batch-input-finished/m-p/695694#M115490 raiqb01 2024-08-08T12:44:27Z https://community.splunk.com/t5/Getting-Data-In/TailReader-TailReader-260668-tailreader0-Batch-input-finished/m-p/695724#M115493 Hi<BR />When you are looking source, it said that this event is from OS auditd not from Splunk’s internal logs. This is the reason why it is in your Linux index.<BR />r. Ismo Thu, 08 Aug 2024 16:42:18 GMT https://community.splunk.com/t5/Getting-Data-In/TailReader-TailReader-260668-tailreader0-Batch-input-finished/m-p/695724#M115493 isoutamo 2024-08-08T16:42:18Z