Simple text file suddenly (but thoroughly) being ignored

mikeely — Wed, 11 Jan 2012 00:53:36 GMT

I've got this little file Oracle appends a row to every hour, and it stopped being monitored mysteriously sometime around the last logrotate (near as I can tell). Now it's not updating, or updating haphazardly. Here's what the file looks like:

10-01-12:08:47:02,         0,         0,         2,         6,       106,         2
10-01-12:08:48:01,         0,         0,         2,         6,       106,         2
10-01-12:08:49:01,         0,         0,         2,         6,       106,         2

Heady stuff, I know. Anyhow, Splunk was indexing that file well enough and now it isn't. Currently, my inputs.conf stanza for it looks like this:

[monitor:///u01/app/oracle/db/tech_st/11.1.0/log/scriptout]

recursive = true

disabled=0

followTail=1

I've tried crcSalt to no avail. I even tried to disable followTail but in the log it said TailingProcessor: starting at offset whatever... and continued to not do what I wanted.

Is there a way to "reset" the entries resulting from this stanza and force a re-index? And why did it die?

Re: Simple text file suddenly (but thoroughly) being ignored

woodcock — Mon, 01 Jun 2015 21:29:30 GMT

The short answer is: do not use followTail=1:
http://answers.splunk.com/answers/57819/when-is-it-appropriate-to-set-followtail-to-true.html

topic Re: Simple text file suddenly (but thoroughly) being ignored in Getting Data In

Simple text file suddenly (but thoroughly) being ignored

Re: Simple text file suddenly (but thoroughly) being ignored