The case at https://community.splunk.com/t5/Getting-Data-In/Issue-on-file-monitoring-using-forwader/m-p/478063#M... is similar.
When files are being ftp'ed to the location we see in _internal errors that the file can't be read. Comes the weekend and this host is being rebooted and the files are being ingested.
We looked at MonitorNoHandle that allows reading while the file is being written on Windows but MonitorNoHandle only allows one such file per stanza.
We asked the customer to ftp the files to another directory and move them later via a script but the customer wasn't thrilled about this idea.
We also thought that maybe there is a way to have the UF check for new files multiple times before putting them in the black list and it doesn't seem to be possible.
What can we do?
