Deployment Architecture

Splunk reading file but not indexing the data

morphis72
Path Finder

I have migrated a docker environment off of an old legacy build to my new Splunk environment.

Some of my data after moving the apps over is not coming in and I can't figure out why.

My inputs.conf file contains this stanza:

[monitor:///var/lib/docker/volumes/.../_data/messages.log]
disabled = false
host_regex = \/var\/lib\/docker\/volumes\/(.*?)\/_data
sourcetype = liberty:messages:json
initCrcLength = 1048575
index = docker_nonprod_11485_7320

I enabled DEBUG and am finding where it appears to be reading the file but then never indexes it.

04-16-2019 20:05:17.817 -0400 DEBUG WatchedFile - seeking /var/lib/docker/volumes/10826-DMA-Int_ui.2.mo31ycyigljai7urzf767unv2/_data/messages.log to off=1202898
04-16-2019 20:05:17.817 -0400 DEBUG WatchedFile - Reached EOF: fname=/var/lib/docker/volumes/10826-DMA-Int_ui.2.mo31ycyigljai7urzf767unv2/_data/messages.log initcrclen=1048575 fishstate=key=0x960a54930e3e00d3 sptr=1202898 scrc=0x389469e89a3b1168 fnamecrc=0x2842e360000b2f69 modtime=1555441508
04-16-2019 20:05:17.817 -0400 DEBUG TailReader - Finished reading file='/var/lib/docker/volumes/10826-DMA-Int_ui.2.mo31ycyigljai7urzf767unv2/_data/messages.log' in tailreader0 thread, disposition=ACKNOWLEDGE_CHANGE, deferredBy=0.000
04-16-2019 20:05:17.817 -0400 DEBUG TailReader - Returning disposition=ACKNOWLEDGE_CHANGE for file=/var/lib/docker/volumes/10826-DMA-Int_ui.2.mo31ycyigljai7urzf767unv2/_data/messages.log

I have tried with crcSalt and with initCrcLength as well as without that setting all together.

Any ideas on what I should be trying here?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...