topic Re: Spotting when a file has been finished indexing? in Getting Data In

Spotting when a file has been finished indexing?

szabados — Mon, 12 Oct 2015 07:33:54 GMT

I have a monitor input, which rarely has new files, and I'd like set up an alert for it. How can I find something about when a file has been finished reading in ?

Re: Spotting when a file has been finished indexing?

MuS — Mon, 12 Oct 2015 08:15:19 GMT

Hi szabados,

take a look at this great blog post http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/ where you learn to use the REST endpoint of the TailingProcessor to show its activities and what files are currently being read.

Hope this helps ...

cheers, MuS

Re: Spotting when a file has been finished indexing?

szabados — Tue, 13 Oct 2015 07:14:58 GMT

Thanks, but my idea was to set up an alert in splunk, based on the contents of the internal log of the forwarder.

Re: Spotting when a file has been finished indexing?

MuS — Wed, 14 Oct 2015 20:50:36 GMT

You could enable debugging on the TailingProcessor on the forwarder http://docs.splunk.com/Documentation/Splunk/6.3.0/Troubleshooting/Enabledebuglogging and look what is reported in index=_internal or read the docs here http://docs.splunk.com/Documentation/Splunk/latest/Data/Troubleshoottheinputprocess