Analyzing Splunk Internal Logs- What is Tailing Processor and Watch file?

[umesh]

Hi Everyone,

I recently observed the splunk internal logs and found that there is a field component and found two values for component field -

1.TailingProcessor

2.Watched file

INFO WatchedFile [3338437 tailreader0] - Will use tracking rule=modtime for file='/path/.conf

INFO TailingProcessor [3338433 MainTailingThread] - Adding watch on path: /path

Please help me understand what these logs says about.

Thanks 

[richgalloway · Accepted solution]

These two components help with the handling of monitor:// inputs.  WatchedFile detects when the file changes and TailingProcessor reads the new data.  The first message says the component will detect changes using the file modification time.  The second message says it's asked WatchedFile to keep an eye on the specified file path.