Getting Data In

Forwarder is reading a file that doesn't match the whitelist

Motivator

I added a directory to monitor, with whitelist = log$

Later after seeing a file I didn't want to include was also being written, I modified this whitelist = startup.log. The other file that doesn't match is still being read, even with the splunkd process being restarted twice.

Here's my current monitor stanza:

[monitor:///app/actional/logs]
whitelist=startup\.log$
sourcetype=actional_startup
index=temp_syslog
disabled = 0

If I look at the TailingProcessor via the REST api, it confirms that the other files are not matching the whitelist:
/app/actional/logs/ActionalIntermediary_20110927_083150_283.log

parent  /app/actional/logs
type    Did not match whitelist 'startup.log$'.

However, searching:
index=temp_syslog source=/app/actional/logs/* NOT source=/app/actional/logs/startup.log does return events from this host matching that ActionalIntermediary log that the TailingProcessor says does not match.

Ideas on what could be wrong?

1 Solution

Splunk Employee
Splunk Employee

I'd bet the events being returned are events that were indexed during the run with the incorrect whitelist - check the tailing status endpoint now for the ActionalIntermediary files...

View solution in original post

Splunk Employee
Splunk Employee

I'd bet the events being returned are events that were indexed during the run with the incorrect whitelist - check the tailing status endpoint now for the ActionalIntermediary files...

View solution in original post

Motivator

Yep, I had used the "All-Time" when performing a |delete operation. So the data I was seeing later was there from before changing the whitelist.

Splunk Employee
Splunk Employee

Your whitelist and inputs.conf stanza seem legit. Are you sure that the events returned by the search were not indexed before the new whitelist came into effect?

0 Karma