https://community.splunk.com/t5/Splunk-Search/Frequency-lea-updates-pointer-file/m-p/77857#M181583 <P>Answering my own post here. <BR /> From what I can tell, the <EM>lea_log_rec_num.cache</EM> file only gets updated upon completion of the script run, meaning, the lea-connector has reached the end of the Checkpoint log file.</P> <P>Therefore, in a high-volume environment, it could take a long time for this script to finish its initial run. </P> <P>Sean</P> Mon, 28 Sep 2020 11:26:31 GMT sdwilkerson 2020-09-28T11:26:31Z https://community.splunk.com/t5/Splunk-Search/Frequency-lea-updates-pointer-file/m-p/77856#M181582 <P>Hello,</P> <P>Does anyone know the frequency that the lea-loggrabber-splunk app's lea_loggrabber process should write to its record-number cache <EM>lea_log_rec_num.cache</EM>?</P> <P>It seems that when Splunk is restarted or if lea_loggrabber is HUPd that this pointer file is not written to so next time the process starts, it gets lots of old data.</P> <P>Also, a side note, is that because this pointer file is written to locally, you CANNOT use Splunk's Deployment Server to push this app since it will over write this record at each deployment/restart.</P> <P>Thanks,</P> <P>Sean</P> Mon, 28 Sep 2020 11:26:23 GMT https://community.splunk.com/t5/Splunk-Search/Frequency-lea-updates-pointer-file/m-p/77856#M181582 sdwilkerson 2020-09-28T11:26:23Z https://community.splunk.com/t5/Splunk-Search/Frequency-lea-updates-pointer-file/m-p/77857#M181583 <P>Answering my own post here. <BR /> From what I can tell, the <EM>lea_log_rec_num.cache</EM> file only gets updated upon completion of the script run, meaning, the lea-connector has reached the end of the Checkpoint log file.</P> <P>Therefore, in a high-volume environment, it could take a long time for this script to finish its initial run. </P> <P>Sean</P> Mon, 28 Sep 2020 11:26:31 GMT https://community.splunk.com/t5/Splunk-Search/Frequency-lea-updates-pointer-file/m-p/77857#M181583 sdwilkerson 2020-09-28T11:26:31Z