Archive

.gz file not getting indexed in splunk

New Member

i am getting this error , every time when i am indexing the .csv.gz file
updated less than 10000ms ago, will not read it until it stops changing.
has stopped changing , will read it now .

inputs.conf :
[monitor:///tmp/*.csv.gz]
sourcetype=test

props.conf:
[test]
CHECK_FOR_HEADER = true
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = csv
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
disabled = false
REPORT-AutoHeader = AutoHeader-6
category = Structured

Tags (1)
0 Karma

Motivator

The line

crcSalt=/tmp/.csv.gz

is incorrect

please use (verbatium)

crcSalt= <SOURCE>
0 Karma

New Member

i have added the crcsalt file like below

[monitor:///tmp/.csv.gz]
sourcetype=test
crcSalt=/tmp/
.csv.gz
ignoreOlderThan=1d

but still i cant see todays sample1.csv.gz file

in log file i can find out

Handling file =/tmp/sample1.csv.gz
ArchivedProcessor - reading Path = /tmp/sample1.csv.gz ( seek=0 len=142048)

but not seeing the data in the splunk indexer.

its showing handling file , reading file but not seeign finished processing file . Kindly need your input .

0 Karma

Motivator

try crcSalt= <SOURCE> in your inputs.conf, also you may want to use batch instead of monitor with a move_policy = sinkhole so it will erase the previous file when indexed.

0 Karma

SplunkTrust
SplunkTrust

That's not an error, Splunk is informing you that it's not going to read the archive until it's confident that the archive has stopped changing.

0 Karma

New Member

No , my env is , everyday new file will be added in that location to monitor , e.g. /tmp/sample1.csv.gz ... , sample2.csv.gz ....only first time it went through ... from day 2 always it's throwing the same info but no data in the indexer . My sample1.csv.gz has the first line in common like same fields everyday .. but from the second line it's different ... is it because of that ... u can find my props.conf and my inputs.conf in my first post .

0 Karma

SplunkTrust
SplunkTrust

So... when you run this over all time, you see nothing? index=main sourcetype=test

Anything here? index=_internal group=per_source_thruput series=*csv.gz*

0 Karma

New Member

No , just showing read it now ... but I am not seeing any data in the indexer , from this particular source.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!