Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Batch not indexing previously locked file
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Batch not indexing previously locked file
Hi,
I have a problem where batch input will not index files that was locked when Splunk first tried to index the file.
The splunkd.log shows the following entries:
02-20-2012 21:15:43.145 +0200 WARN TailingProcessor - Will retry file='c:\data\data_20120220211543083.log' in 10000ms due to: The process cannot access the file because it is being used by another process.
02-20-2012 21:15:53.005 +0200 ERROR TailingProcessor - Ignoring path due to: failed to open for checksum: 'c:\data\data_20120220211543083.log' (The process cannot access the file because it is being used by another process.)
The file remains in the directory even after it is no longer locked and no further entries are found in splunkd.log for the file 12 hours after the initial entries.
Other files that are not locked get indexed and deleted.
How can I get Splunk to index the previously locked files?
inputs.conf
[batch://c:\data]
sourcetype=AuditData
move_policy = sinkhole
crcSalt =
System: Windows 2008 R2 64-bit, Splunk 4.2.4
Thx
Joon
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Suggest taking a look at this:
http://splunk-base.splunk.com/answers/53046/apache-rotatelogsexe-interfering-with-splunk-indexing
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
did you try moving the file into a subdirectory?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am not in batch mode locked files can be indexed if they are being used by another process...I know it does when on monitor mode
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thx, moving the files got them indexed, but it does not solve the underlying issue. The locked files do not get indexed.
Any ideas on that?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
