topic Re: Splunk adds .filepart to file name in Getting Data In

Splunk adds .filepart to file name

AlexMcDuffMille — Thu, 09 Jan 2014 14:32:32 GMT

Hello,

I put about 500 files on a server (between 2 directories) and was looking through the data. It seemed that most of the files were broken up line by line, but some of the files were not broken up and were saved as single events with multiple lines. Also, the source for some of the events were changed from the original file name (example1.log) to filename.filepart (example1.log.filepart).

Does anyone know what the .filepart means?

Thanks!

Re: Splunk adds .filepart to file name

Ayn — Thu, 09 Jan 2014 17:11:59 GMT

This is not due to anything Splunk does, but more likely because you've used some kind of file transfer software to transfer files to a directory Splunk is monitoring. WinSCP for instance will do this - while the file is transferred it will be called <filename>.filepart, then when the transfer is complete the file will be renamed to the original filename. Splunk will however pick up data directly when it appears, that is, before the file transfer is complete, and so will pull data while the file is still called <filename>.filepart.

Re: Splunk adds .filepart to file name

AlexMcDuffMille — Thu, 09 Jan 2014 22:36:52 GMT

Is there anyway to prevent this from happening? I guess in the future I'll be sure to make sure it's uploaded before changing my inputs.conf to include the directory.

Re: Splunk adds .filepart to file name

Ayn — Fri, 10 Jan 2014 07:25:32 GMT

Sure, you can use blacklists in inputs.conf. Have a look at the docs: http://docs.splunk.com/Documentation/Splunk/6.0/admin/inputsconf

So for instance

[monitor:///some/directory]
blacklist = \.filepart$