Splunk forwarder not processing batch input

cku1 — Sun, 21 Mar 2021 15:00:29 GMT

Hi All,

I have a deployment app which successfully deployed to a server with the splunk forwarder installed, but which fails to process the files I want.

My /opt/splunkforwarder/etc/apps/TA-VPS_Inputs_Reconciliation/default/input.conf contains the following. There is no inputs.conf in ../local/

(sst)[splunk@myserver default]$ more inputs.conf # Reconciliaiton Report csv written by Incentage # # For report csv files. Using batch input to ensure processed files are deleted [batch:///opt/incentage/dev/components/data/jsonConvToReconciliation/reconciliationreports/*.csv] move_policy = sinkhole index = dev_reconciliation sourcetype = reconciliation:report [batch:///opt/incentage/uat/components1/data/jsonConvToReconciliation/reconciliationreports/*.csv] move_policy = sinkhole index = uat_reconciliation sourcetype = reconciliation:report

The splunk user can see and delete the *.files under the input directory. but the files are not being processed.

(sst)[splunk@myserver default]$ ls -la /opt/incentage/dev/components/data/jsonConvToReconciliation/reconciliationreports/*.csv -rw-rw-r--. 1 imsadm imsadm 1872 Mar 21 14:28 /opt/incentage/dev/components/data/jsonConvToReconciliation/reconciliationreports/2021032114284000005.csv -rw-rw-r--. 1 imsadm imsadm 1872 Mar 21 15:21 /opt/incentage/dev/components/data/jsonConvToReconciliation/reconciliationreports/2021032114284000006.csv

I have no errors or warnings in the splunkd.log but see that the autodeployment worked.

I also tried changing from batch:// to monitor:// with no luck (I commented the move_policy= line)
I have also tried changing the input path to not include the wildcard *.csv

Any ideas where to look?

Re: Splunk forwarder not processing batch input

richgalloway — Sun, 21 Mar 2021 17:39:57 GMT

Did you restart the forwarder after deploying the new inputs.conf file?

Re: Splunk forwarder not processing batch input

cku1 — Sun, 21 Mar 2021 18:47:34 GMT

Thank you kind Sir!

Just what I needed to hear. I thought that would happen automatically as I saw in the log that the new App was being downloaded from the deploy server, and installed. However I have now checked the app settings on the server and see that the restart option is not enabled.

I've restarted the service now (On the server where the splunk forwarder is installed

> sudo su - splunk

> cd bin/

> ./splunk restart

topic Re: Splunk forwarder not processing batch input in Getting Data In

Splunk forwarder not processing batch input

Re: Splunk forwarder not processing batch input

Re: Splunk forwarder not processing batch input