topic Re: splunk in Monitoring Splunk

splunk

loknath — Fri, 17 Jan 2025 06:50:55 GMT

Hello Everyone

this is how iam getting error massage , while forwarding data from universal forwarder to indexer ,

This is the i got from error logs , Iam not able to understand : can anyone help me in this >

01-17-2025 06:32:15.605 +0000 INFO TailReader [1654 tailreader0] - Batch input finished reading file='/opt/splunkforwarder/var/spool/splunk/tracker.log'

Re: splunk

isoutamo — Fri, 17 Jan 2025 07:09:33 GMT

This is not an error message. It just informs you that this file has read.
Is this totally new splunk environment or just a new uf which haven’t sent logs before to splunk.

Re: splunk

kiran_panchavat — Fri, 17 Jan 2025 08:58:54 GMT

@loknath The TailReader in Splunk is a component responsible for monitoring and collecting data written to the end of a file being monitored. It's part of the File Monitor Input feature, which allows Splunk to tail files and continuously read new data as it is appended to the file.