Getting Data In

Are there any easier way to check file monitoring status beside using TailingProcessor:FileStatus output

Splunk Employee
Splunk Employee

I know I can use this command to check the file monitoring status, however, it give a huge output.

./splunk _internal call /services/admin/inputstatus/TailingProcessor:FileStatus -auth admin:changeme



Are there any other command which also do the job?

0 Karma

Splunk Employee
Splunk Employee

Starting from splunk version 6.3 and later, you can use this command.

./splunk list inputstatus

It will return something like this.

Cooked:tcp :
                time opened = 2017-07-09T17:28:47+0800

            file position = 434781
            file size = 434781
            parent = $SPLUNK_HOME/var/log/splunk
            percent = 100.00
            type = finished reading

Here is the meaning of the output:

file position: The file pointer position that Splunk is currently reading at. If this is the same as file size, that means Splunk reach end of file (EOF).

file size : Total file size of the monitored file.

parent : If you are monitoring a directory, this tell you from which monitoring stanza the file is come from.

percent : The progress of the monitoring. If it is less than 100%, Splunk will re-visit the file again.

type: The monitoring status. It can be ‘finished reading’, ‘open file’, ‘missing’, ’directory’, 'reading (batch)'.

Remark: If you saw 'reading (batch)', that means the file that you are monitoring is greater than min_batch_size_bytes under limits.conf (default is 20M in size) and Splunk is using batch processor to process the file. It is a single thread process and will process one file at a time. (TailingProcessor is multi thread process).

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!