Getting Data In

How do I know if universal forwarder has finished reading and complteted forwarding data to indexers?

Motivator

Hi,

I have been looking for information about REST API point to know if UF has completed reading the file and sending events to indexer, or simply waiting for events to be logged to monitored file:

/services/admin/inputstatus/TailingProcessor:FileStatus 

I am trying to track if universal forwarder is reading files monitored or completed sending events.

some key shows type="open file", and others showing "finished reading".
Could anyone know the difference between "open file" and "finished reading"?
If there are more status for file input, I would like to know the information about the status of file being monitored.

<s:key name="/root/test.log">
<s:dict>
<s:key name="file position">2252994</s:key>
<s:key name="file size">2252994</s:key>
<s:key name="percent">100.00</s:key>
<s:key name="type">**open file**</s:key>
</s:dict>
</s:key>

and,

<s:key name="/opt/splunkforwarder/var/log/splunk/license_audit.log">
<s:dict>
<s:key name="file position">0</s:key>
<s:key name="file size">0</s:key>
<s:key name="parent">$SPLUNK_HOME/var/log/splunk/splunkd.log</s:key>
<s:key name="percent">100</s:key>
<s:key name="type">**finished reading**</s:key>
</s:dict>
</s:key>

Any information would be appreciated.

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Splunk assumes that a new event can always be added to any file, so it will keep monitoring every files.

about the REST endpoint, when the percent is 100% :

  • "finished reading" means that the file has been read and forwarded till the end
  • "open file" means the same, but in addition the handle on the file is still open (because it has been less than 3 seconds, or because an option in inputs.conf request to keep the file open to tail new events, or because the file has just being reopen to check if they were any update or rotation)

View solution in original post

Splunk Employee
Splunk Employee

Splunk assumes that a new event can always be added to any file, so it will keep monitoring every files.

about the REST endpoint, when the percent is 100% :

  • "finished reading" means that the file has been read and forwarded till the end
  • "open file" means the same, but in addition the handle on the file is still open (because it has been less than 3 seconds, or because an option in inputs.conf request to keep the file open to tail new events, or because the file has just being reopen to check if they were any update or rotation)

View solution in original post

Motivator

Thank you for your answer, I am looking for this type of information in a documentation, but I still can not find it. I would really appreciate if you point me to the location in a doc or any other location.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!