Index Large File

[rgaleone1]

Context:
When attempting to index a massive log (>30GB) I am not seeing Splunk log percent complete, status, or errors in the _internal index. I see the tailingprocessor adding watch on my path, but I never see an end log when/if the file indexing in complete.

Ask:
Is the _internal index the location I should be looking for errors/success/status logs?

[Ayn · Accepted solution]

The best place to look might be in the TailingProcessor's own status endpoint. There you can see which status each monitor input currently has. Read more about it here: http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/