topic Re: Logs are stopped genarating from 2nd april in Getting Data In

Logs are stopped genarating from 2nd april

anil1432 — Wed, 26 May 2021 12:45:09 GMT

My logs showing before April 2nd only when I check for previous 7 days it's not showing what may be the issue please share solution to us . But there is no error is showing . In actuall the log is batchdog.log under this log there are similar logs are rolled like batchdog.lig.mmddyy.*log

Any help please . There is no issues in splunkd.log also

Re: Logs are stopped genarating from 2nd april

isoutamo — Wed, 26 May 2021 13:34:09 GMT

Hi
Are you sure that your date is parsed correctly in ingest phase? 2/4/2021 vs 4/2/2021?
r. Ismo

Re: Logs are stopped genarating from 2nd april

anil1432 — Thu, 27 May 2021 02:41:12 GMT

Yes I checked all my data is parsing well.

My logs are stopped genarating from 3rd April and when I check for 2nd April it's showing logs . And there is no issues available in splunkd.log . And all my configuration are running fine . But only not genarating specific path file only to a particular user . Plz hep me out

Re: Logs are stopped genarating from 2nd april

anil1432 — Thu, 27 May 2021 02:42:32 GMT

My splunk enterprise version is 7.3.2

Re: Logs are stopped genarating from 2nd april

isoutamo — Thu, 27 May 2021 06:33:46 GMT

On UF side what it shows when you are writing as splunk/root (user which runs splunkd at UF):

splunk list inputstatus

You should find entry for that file like:

/....../splunk/var/log/watchdog/watchdog.log file position = 5427 file size = 5427 parent = $SPLUNK_HOME/var/log/watchdog/watchdog.log* percent = 100.00 type = finished reading

This show if those files are read to end or are there something unread.

Are you getting any logs from that UF or only some?

Re: Logs are stopped genarating from 2nd april

anil1432 — Thu, 27 May 2021 07:38:59 GMT

these are the errors I find outed sir

Re: Logs are stopped genarating from 2nd april

isoutamo — Thu, 27 May 2021 15:07:15 GMT

Can you post your inputs.conf and splunk list inputstatus?

Re: Logs are stopped genarating from 2nd april

anil1432 — Thu, 27 May 2021 15:43:56 GMT

I checked they are fine

Re: Logs are stopped genarating from 2nd april

anil1432 — Thu, 27 May 2021 15:53:39 GMT

It's for only one user it's happening . When I check for 2nd April these are logs genarating. In inputs they give correct path only and monitor the path is good

thanks in advance,😊

Re: Logs are stopped genarating from 2nd april

anil1432 — Thu, 27 May 2021 16:34:54 GMT

Let me try this? It will work or not?

/opt/splunk/var/log/watchdog/watchdog.log

file position = 2518300

file size = 2518300

parent = $SPLUNK_HOME/var/log/watchdog/watchdog.log*

percent = 100.00

type = open file

/opt/splunk/var/log/watchdog/watchdog.log.1

file position = 25000101

file size = 25000101

parent = $SPLUNK_HOME/var/log/watchdog/watchdog.log*

percent = 100.00

type = finished reading