Batch not indexing previously locked file

[joonradley]

Hi,

I have a problem where batch input will not index files that was locked when Splunk first tried to index the file.

The splunkd.log shows the following entries:

02-20-2012 21:15:43.145 +0200 WARN TailingProcessor - Will retry file='c:\data\data_20120220211543083.log' in 10000ms due to: The process cannot access the file because it is being used by another process.

02-20-2012 21:15:53.005 +0200 ERROR TailingProcessor - Ignoring path due to: failed to open for checksum: 'c:\data\data_20120220211543083.log' (The process cannot access the file because it is being used by another process.)

The file remains in the directory even after it is no longer locked and no further entries are found in splunkd.log for the file 12 hours after the initial entries.

Other files that are not locked get indexed and deleted.

How can I get Splunk to index the previously locked files?

inputs.conf
[batch://c:\data]
sourcetype=AuditData
move_policy = sinkhole
crcSalt =

System: Windows 2008 R2 64-bit, Splunk 4.2.4

Thx

Joon

[NiklasB]

Suggest taking a look at this:
http://splunk-base.splunk.com/answers/53046/apache-rotatelogsexe-interfering-with-splunk-indexing

[MarioM]

did you try moving the file into a subdirectory?

[MarioM]

I am not in batch mode locked files can be indexed if they are being used by another process...I know it does when on monitor mode

[joonradley]

Thx, moving the files got them indexed, but it does not solve the underlying issue. The locked files do not get indexed.

Any ideas on that?