Getting Data In

File Monitroring issue- Why did csv file stop getting ingested into splunk after few hours?

Zacknoid
Explorer

facing this issue second time, and tried almost every possible way out in last 2 months, so here is the csv file we're which is getting referesh in every 1 hour, ( it may or may not contain new events )

We observed after few hours file stop getting into splunk and after splunk restart again it start ingesting data.

In the splunkd logs its says ignoring path,

I have tried crcSalt, initCrcLenth but non worked in my case

All i want splunk is to read new file always no matter is there is new events or not, just stay updated with file
( i cannot add counter in file )

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's not how Splunk works to monitor files.  Splunk looks for *new* data because it already has the old data.  Completely replacing the file confuses the heck out of the monitor.

If the file is untouched except for the hourly refresh then consider a batch input instead of a monitor.  Keep in mind that Splunk will delete the file after ingesting it so this may not be the right choice if the file is needed for other purposes.

Another option is a scripted input.  Write a short Python script that reads the file and write it to stdout.  Set up that script as a Splunk Scripted Input to run every hour a few minutes after the file is scheduled to refresh.  Splunk will ingest everything written to stdout and the file will remain.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...