Getting Data In
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: How to exclude from monitoring empty files?
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
apakhomov
Path Finder
07-02-2015
01:58 AM
Hello,
Monitor folders have many empty files. These files may be filled in the future. So I can't add them to a blacklist.
As result the log file splunkd.log has huge amount messages:
INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='<filename>'.
I don't want to reduce the log level.
Is it possible to exclude from monitoring empty files to reduce the message count in the log?
--
Best regards, Artem.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
woodcock
Esteemed Legend
07-02-2015
05:51 AM
You could dump some filler into each file:
echo "FILLER: This is not real data but just filler text to suppress this log: INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='<filename>'." > <filename>.
Then configre props.conf and transforms.conf to send these events to nullQueue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
woodcock
Esteemed Legend
07-02-2015
05:51 AM
You could dump some filler into each file:
echo "FILLER: This is not real data but just filler text to suppress this log: INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='<filename>'." > <filename>.
Then configre props.conf and transforms.conf to send these events to nullQueue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
apakhomov
Path Finder
07-15-2015
12:15 AM
Hello, sorry for the delay.
It is fantastic solution and I marked this as a solution. But unfortunately I can't to change the source files (even empty).
Best regards, Artem.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
woodcock
Esteemed Legend
07-15-2015
07:41 AM
Whatever you do, DO NOT use ignoreOlderThan because once Splunk ignores a file via this control, it will never check it again.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
apakhomov
Path Finder
07-15-2015
07:48 AM
ok, thank you for the useful information.
Best regards, Artem.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
apakhomov
Path Finder
07-15-2015
10:55 PM
Universal forwarder start to reindex files when I commented the ignoreOlderThan parameter. I saw it today. The bitter experience with another task.
Best regards, Artem.
Get Updates on the Splunk Community!
Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco
The Defining Technology Movement of Our Lifetime
The advent of agentic AI is arguably the defining technology ...
Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data
In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...
Your summer travels continue with new course releases
Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...
