topic Re: Log files not indexing. in Getting Data In

Log files not indexing.

sathiyasun — Tue, 29 Sep 2020 20:11:42 GMT

When I configured log file monitoring it worked only on that day till 11:59PM and then no events are getting indexed. Please recommend.

In splunkd.log have been getting the message.

06-25-2018 17:12:21.197 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/amz/xyz/logs/sap/prod1/cbc/xyz_3.0.log-2018.05.11.gz'.
06-25-2018 17:12:31.201 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/amz/xyz/logs/sap/prod1/cbc/xyz_3.0.log-2018.05.11.gz'.

Inputs.conf

[monitor:///opt/amz/xyz/logs/sap/prod1/cbc/xyz_3.0.log-*]
whitelist = OrderFulfillment_3.0.log-\d{4}.\d{2}.\d{2}
disabled = false
index = main
sourcetype = sap
initCrcLength = 256

Re: Log files not indexing.

frankwayne — Tue, 26 Jun 2018 01:15:44 GMT

Can you provide an example of the events that are not getting indexed, especially the timestamps?

Re: Log files not indexing.

MuS — Tue, 26 Jun 2018 02:17:18 GMT

... worked only on that day til 11:59pm ...

sounds like this is related to a log rotate happening then. Might be worth reading this first http://docs.splunk.com/Documentation/Splunk/latest/Data/Howlogfilerotationishandled and afterwards this answer https://answers.splunk.com/answers/185453/why-copytruncate-logrotate-does-not-play-well-with.html

cheers, MuS

Re: Log files not indexing.

pruthvikrishnap — Tue, 26 Jun 2018 06:46:42 GMT

Hi Satya,
This may be because Splunk was not able to read the correct timestamp in the file, sometimes it's thinking them as dd/mm/yyyy and sometimes as mm/dd/yyyy, please go through the doc below.

https://docs.splunk.com/Documentation/SplunkCloud/7.0.0/Data/Configuretimestamprecognition#Enhanced_strptime.28.29_support

Let me know if it works.