Getting Data In

Does splunk forwarder lock files when reading them?

pacrip
Path Finder

I have a script that generates log files which are stored in an area spidered by a splunk forwarder. Whilst running my script i have come across an error which i have traced back to splunk forwarding the data generated at the beginning of the script whilst i am trying to save data to that log file. If I disable splunk forwarder the script runs fine and on all the other machines i have tested it on it is fine as well. am i just really unlucky with the write time of my data and the read time of splunk or does it sound like there is there something deeper here?

(PS also if i put a line in the script that makes it wait half a second before executing the line that fails, that makes it run fine as well.)

0 Karma

barakreeves
Splunk Employee
Splunk Employee

No, forwarders do not lock files. Please see this Answers: http://answers.splunk.com/answers/31301/does-forwarders-put-a-lock-on-a-log-file-while-forwarding

Curious: does you script try to put a lock on a file? if the file is open by Splunk, it may be the reason your script is failing. Is this a bash, perl, or python script?

barakreeves
Splunk Employee
Splunk Employee

Please keep us updated.

0 Karma

pacrip
Path Finder

Nope, the script is written in powershell and uses a logging module (http://gallery.technet.microsoft.com/scriptcenter/Write-timestamped-output-4ff1565f) to push lines to the file. I used a file handle reader in my error handling and the only process that had access to the file having issues was splunk forwarder which had it open with full (RWD) access. Im taking a look at the logging module to see if the way it saves could be the culprit

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...