https://community.splunk.com/t5/Getting-Data-In/How-to-configure-parameter-for-TailingProcessor-to-automatically/m-p/114008#M97632 <P>Before ask Splunk to do this more times, have you checked:</P> <OL> <LI>Does the file exist?</LI> <LI>Splunk is running under some user credentials. Is this file accessible by that user?</LI> <LI>Does another process have the file locked so that Splunk cannot read it?</LI> </OL> Sat, 06 Sep 2014 23:41:10 GMT lguinn2 2014-09-06T23:41:10Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-parameter-for-TailingProcessor-to-automatically/m-p/114007#M97631 <P>It took a while to copy the large logfile over the slow network, and it looks like the TailingProcessor gave up after 2 tries:<BR /> <PRE><CODE><BR /> 09-06-2014 15:17:03.607 -0700 WARN FileClassifierManager - Unable to open 'D:\Logs\syslog2014-09-05'.<BR /> 09-06-2014 15:17:03.607 -0700 WARN FileClassifierManager - The file 'D:\Logs\syslog2014-09-05' is invalid. Reason: cannot_read<BR /> 09-06-2014 15:17:03.607 -0700 INFO TailingProcessor - Ignoring file 'D:\Logs\syslog2014-09-05' due to: cannot_read<BR /> 09-06-2014 15:22:47.707 -0700 WARN FileClassifierManager - Unable to open 'D:\Logs\syslog2014-09-05'.<BR /> 09-06-2014 15:22:47.707 -0700 WARN FileClassifierManager - The file 'D:\Logs\syslog2014-09-05' is invalid. Reason: cannot_read<BR /> 09-06-2014 15:22:47.707 -0700 INFO TailingProcessor - Ignoring file 'D:\Logs\syslog2014-09-05' due to: cannot_read<BR /> </CODE></PRE></P> <P>Any way to make it automatically retry a couple more times (via some configuration parameter somewhere)?<BR /> Using Splunk v6.1.3 for Windows.</P> Mon, 28 Sep 2020 17:30:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-parameter-for-TailingProcessor-to-automatically/m-p/114007#M97631 NK_1 2020-09-28T17:30:39Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-parameter-for-TailingProcessor-to-automatically/m-p/114008#M97632 <P>Before ask Splunk to do this more times, have you checked:</P> <OL> <LI>Does the file exist?</LI> <LI>Splunk is running under some user credentials. Is this file accessible by that user?</LI> <LI>Does another process have the file locked so that Splunk cannot read it?</LI> </OL> Sat, 06 Sep 2014 23:41:10 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-parameter-for-TailingProcessor-to-automatically/m-p/114008#M97632 lguinn2 2014-09-06T23:41:10Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-parameter-for-TailingProcessor-to-automatically/m-p/114009#M97633 <OL> <LI>Yes.</LI> <LI>Yes.</LI> <LI>Yes, during the slow copy process.</LI> </OL> <P>If the file was small and/or the copy process was fast, Splunk indexes the file fine.</P> Sat, 06 Sep 2014 23:51:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-parameter-for-TailingProcessor-to-automatically/m-p/114009#M97633 NK_1 2014-09-06T23:51:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-parameter-for-TailingProcessor-to-automatically/m-p/114010#M97634 <P>Is there any way to set the copy process so that that it doesn't lock the file?</P> <P>Is it possible to forward the file from its original location?</P> Sun, 07 Sep 2014 06:45:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-parameter-for-TailingProcessor-to-automatically/m-p/114010#M97634 lguinn2 2014-09-07T06:45:48Z