Getting Data In

Log files not indexing.

sathiyasun
Explorer

When I configured log file monitoring it worked only on that day till 11:59PM and then no events are getting indexed. Please recommend.

In splunkd.log have been getting the message.

06-25-2018 17:12:21.197 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/amz/xyz/logs/sap/prod1/cbc/xyz_3.0.log-2018.05.11.gz'.
06-25-2018 17:12:31.201 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/amz/xyz/logs/sap/prod1/cbc/xyz_3.0.log-2018.05.11.gz'.

Inputs.conf

[monitor:///opt/amz/xyz/logs/sap/prod1/cbc/xyz_3.0.log-*]
whitelist = OrderFulfillment_3.0.log-\d{4}.\d{2}.\d{2}
disabled = false
index = main
sourcetype = sap
initCrcLength = 256

0 Karma

pruthvikrishnap
Contributor

Hi Satya,
This may be because Splunk was not able to read the correct timestamp in the file, sometimes it's thinking them as dd/mm/yyyy and sometimes as mm/dd/yyyy, please go through the doc below.

https://docs.splunk.com/Documentation/SplunkCloud/7.0.0/Data/Configuretimestamprecognition#Enhanced_...

Let me know if it works.

0 Karma

frankwayne
Path Finder

Can you provide an example of the events that are not getting indexed, especially the timestamps?

0 Karma

MuS
SplunkTrust
SplunkTrust

... worked only on that day til 11:59pm ...

sounds like this is related to a log rotate happening then. Might be worth reading this first http://docs.splunk.com/Documentation/Splunk/latest/Data/Howlogfilerotationishandled and afterwards this answer https://answers.splunk.com/answers/185453/why-copytruncate-logrotate-does-not-play-well-with.html

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...