https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-TailReader-errors-and-data-loss-using-universal/m-p/471124#M80988 <P>I've been dealing with this TailReader error for a while and was not able to fix it despite reading all answers and similar questions. I'm still experiencing data loss every day.</P> <P>As you can see in below <CODE>.confs</CODE> I already disabled <CODE>indexed_extraction</CODE> since the universal forwarder doesn't extract field at index time, but still getting that error.</P> <P>I was told to migrate to a heavy forwarder, but I prefer to solve it on UF if possible.</P> <P>I appreciate any help.</P> <P><CODE>inputs.conf</CODE></P> <PRE><CODE>[monitor:///home/audit/oracle/*/v1[12]*.log] disabled = 0 index = ora sourcetype = oracle:audit:json blacklist = (ERROR|lost|ORA|#|DONE) crcSalt = initCrcLength = 1000 ignoreOlderThan = 4h alwaysOpenFile = 1 interval = 30 </CODE></PRE> <P><CODE>props.conf</CODE></P> <PRE><CODE>[oracle:audit:json] DATETIME_CONFIG = CURRENT #INDEXED_EXTRACTIONS = JSON KV_MODE = none MAX_EVENTS = 5 TRUNCATE = 0 TRANSFORMS-TCP_ROUTING_GNCS = TCP_ROUTING_GNCS TRANSFORMS-hostoverride = hostoverride TRANSFORMS-HOST_JSON = HOST_JSON TRANSFORMS-sourcetype_json11 = sourcetype_json11 TRANSFORMS-sourcetype_json12 = sourcetype_json12 TRANSFORMS-sourcetype_sql11 = sourcetype_sql11 TRANSFORMS-sourcetype_sql12 = sourcetype_sql12 </CODE></PRE> Sat, 06 Jun 2020 23:17:13 GMT Behnam67 2020-06-06T23:17:13Z https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-TailReader-errors-and-data-loss-using-universal/m-p/471124#M80988 <P>I've been dealing with this TailReader error for a while and was not able to fix it despite reading all answers and similar questions. I'm still experiencing data loss every day.</P> <P>As you can see in below <CODE>.confs</CODE> I already disabled <CODE>indexed_extraction</CODE> since the universal forwarder doesn't extract field at index time, but still getting that error.</P> <P>I was told to migrate to a heavy forwarder, but I prefer to solve it on UF if possible.</P> <P>I appreciate any help.</P> <P><CODE>inputs.conf</CODE></P> <PRE><CODE>[monitor:///home/audit/oracle/*/v1[12]*.log] disabled = 0 index = ora sourcetype = oracle:audit:json blacklist = (ERROR|lost|ORA|#|DONE) crcSalt = initCrcLength = 1000 ignoreOlderThan = 4h alwaysOpenFile = 1 interval = 30 </CODE></PRE> <P><CODE>props.conf</CODE></P> <PRE><CODE>[oracle:audit:json] DATETIME_CONFIG = CURRENT #INDEXED_EXTRACTIONS = JSON KV_MODE = none MAX_EVENTS = 5 TRUNCATE = 0 TRANSFORMS-TCP_ROUTING_GNCS = TCP_ROUTING_GNCS TRANSFORMS-hostoverride = hostoverride TRANSFORMS-HOST_JSON = HOST_JSON TRANSFORMS-sourcetype_json11 = sourcetype_json11 TRANSFORMS-sourcetype_json12 = sourcetype_json12 TRANSFORMS-sourcetype_sql11 = sourcetype_sql11 TRANSFORMS-sourcetype_sql12 = sourcetype_sql12 </CODE></PRE> Sat, 06 Jun 2020 23:17:13 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-TailReader-errors-and-data-loss-using-universal/m-p/471124#M80988 Behnam67 2020-06-06T23:17:13Z