Getting Data In

Analyzing Splunk Internal Logs- What is Tailing Processor and Watch file?

umesh
Path Finder

Hi Everyone,

 

I recently observed the splunk internal logs and found that there is a field component and found two values for component field -

1.TailingProcessor

2.Watched file

INFO WatchedFile [3338437 tailreader0] - Will use tracking rule=modtime for file='/path/.conf

INFO TailingProcessor [3338433 MainTailingThread] - Adding watch on path: /path

Please help me understand what these logs says about.

Thanks 

 

 

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

These two components help with the handling of monitor:// inputs.  WatchedFile detects when the file changes and TailingProcessor reads the new data.  The first message says the component will detect changes using the file modification time.  The second message says it's asked WatchedFile to keep an eye on the specified file path.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

These two components help with the handling of monitor:// inputs.  WatchedFile detects when the file changes and TailingProcessor reads the new data.  The first message says the component will detect changes using the file modification time.  The second message says it's asked WatchedFile to keep an eye on the specified file path.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...