https://community.splunk.com/t5/Getting-Data-In/Splunk-App-Fortinet-Fortigate/m-p/431210#M75455 <P>I have firewall data coming to my syslog server.The syslog file gets rotated every 24 hours. Ive installed forwarder on the syslog server. I have a monitoring stanza in my Fortinet FortiGate App for Splunk(TA) .</P> <PRE><CODE>[monitor:///bbbb/aaaaa/xxxxxxx/syslog.log] index = fortinet sourcetype = fgt_log </CODE></PRE> <P>Earlier the logs used to come, now the data has stopped coming. It says:</P> <PRE><CODE>07-10-2018 14:10:39.143 +0530 WARN TailReader - Enqueuing a very large file=/bbbb/aaaaa/xxxxxxx/syslog.log in the batch reader, with bytes_to_read=2626817453, reading of other large files could be delayed 07-10-2018 04:56:18.424 +0530 WARN DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event. Defaulting to timestamp of previous event (Tue Jul 10 04:56:02 2018). Context: source::/bbbb/aaaaa/xxxxxxx/syslog.log|host::XXXX|fgt_log|2414. </CODE></PRE> <P>tried reinstalling the forwarder, thruput = 0, initcrclength = 1024 but no luck!</P> <P>Splunk version - 6.5.7<BR /> Fortinet FortiGate App for Splunk- 1.4</P> <P>Any suggestions?</P> Tue, 10 Jul 2018 15:01:43 GMT vinod94 2018-07-10T15:01:43Z https://community.splunk.com/t5/Getting-Data-In/Splunk-App-Fortinet-Fortigate/m-p/431210#M75455 <P>I have firewall data coming to my syslog server.The syslog file gets rotated every 24 hours. Ive installed forwarder on the syslog server. I have a monitoring stanza in my Fortinet FortiGate App for Splunk(TA) .</P> <PRE><CODE>[monitor:///bbbb/aaaaa/xxxxxxx/syslog.log] index = fortinet sourcetype = fgt_log </CODE></PRE> <P>Earlier the logs used to come, now the data has stopped coming. It says:</P> <PRE><CODE>07-10-2018 14:10:39.143 +0530 WARN TailReader - Enqueuing a very large file=/bbbb/aaaaa/xxxxxxx/syslog.log in the batch reader, with bytes_to_read=2626817453, reading of other large files could be delayed 07-10-2018 04:56:18.424 +0530 WARN DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event. Defaulting to timestamp of previous event (Tue Jul 10 04:56:02 2018). Context: source::/bbbb/aaaaa/xxxxxxx/syslog.log|host::XXXX|fgt_log|2414. </CODE></PRE> <P>tried reinstalling the forwarder, thruput = 0, initcrclength = 1024 but no luck!</P> <P>Splunk version - 6.5.7<BR /> Fortinet FortiGate App for Splunk- 1.4</P> <P>Any suggestions?</P> Tue, 10 Jul 2018 15:01:43 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-App-Fortinet-Fortigate/m-p/431210#M75455 vinod94 2018-07-10T15:01:43Z https://community.splunk.com/t5/Getting-Data-In/Splunk-App-Fortinet-Fortigate/m-p/431211#M75456 <P>Hi @ vinod94 ,<BR /> can you please check your props.conf file.</P> Tue, 29 Jan 2019 12:27:00 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-App-Fortinet-Fortigate/m-p/431211#M75456 MoniM 2019-01-29T12:27:00Z https://community.splunk.com/t5/Getting-Data-In/Splunk-App-Fortinet-Fortigate/m-p/431212#M75457 <P>Thank you!</P> Sat, 03 Aug 2019 15:06:12 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-App-Fortinet-Fortigate/m-p/431212#M75457 vinod94 2019-08-03T15:06:12Z