Getting Data In

How can I resolve Splunk input offset?

joe06031990
Communicator

Hi,

I am onboarding the /var/log/secure path and i am getting the bellow about offset 

INFO WatchedFile

/path/to/file.log

Will begin reading at offset=253 for file

Just wondered what I could do to resolve this?

 

Thanks,

Joe

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There is nothing you need to do.  The message is informational and is just Splunk telling you what it is doing.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is nothing you need to do.  The message is informational and is just Splunk telling you what it is doing.

---
If this reply helps you, Karma would be appreciated.
0 Karma

joe06031990
Communicator

Hi, I have two servers with identical server classes and apps one has onboard /var/log/secure and one has not, the one that has not has that message about the offset but the one which has doesn't have the offset message.

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...