topic Re: Index monitoring issues in Getting Data In

Index monitoring issues

Ant1D — Tue, 31 Aug 2010 20:06:53 GMT

Hi,

My instance of Splunk is monitoring a server log file that is updated at periods throughout the day. Splunk has indexed the data from this log file however, the new data that has gone into the log file today has not been indexed by Splunk. (Splunk is still monitoring this file) Any reasons why this is the case?

I am using Windows, the server is also using Windows. I am monitoring a .txt file that is updated at times during the day. I am using Splunk v4.1.3

Re: Index monitoring issues

Lowell — Tue, 31 Aug 2010 20:11:18 GMT

Please update your question with some additional information: What version of splunk are you using, which OS, and what application are you monitoring (some Windows apps are known to cause problems like this because of how they write to the log file.)

Re: Index monitoring issues

Lowell — Tue, 31 Aug 2010 20:18:22 GMT

There are some additional troubleshooting techniques outlined here:

http://answers.splunk.com/questions/6198/what-is-isnt-getting-monitored-and-why

Re: Index monitoring issues

Ant1D — Tue, 31 Aug 2010 20:22:11 GMT

Splunk is able to see all of the events in this .txt file up to last Friday. Since then, today more data has been entered into the .txt file but Splunk has not indexed that data.

Re: Index monitoring issues

Ant1D — Tue, 31 Aug 2010 20:34:51 GMT

\...\c$\Temp/s:key /s:dict /s:key

Why is this missing file size, file position, and type tags?

Re: Index monitoring issues

Ant1D — Tue, 31 Aug 2010 23:58:09 GMT

This helped me to reach an answer so thank you very much.