Deployment Architecture

UF not reading all the logs in a log file

rahulhari88
Explorer

Observed a peculiar case where UF in a syslog is not reading the complete log file . If for example there exists a pan log for 4th Nov with logs available for every hour in that log file . UF seems to read only the first 4 hours and then stops ingesting to the cloud .The next day when new file log ie 5th Nov file is created it again starts to read that log file for couple of hours and then stops .

Points to be noted :

There is only one log file (2022-11-05.log)  which keeps updating as logs get pushed to the syslog from the network host .
Size of the log for one day is around 500 GB plus
No CRC is used in the input setting .

Can you let me know what is causing the UF to stop reading the complete log file

Labels (1)
0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...