Log files not indexing.

[sathiyasun]

When I configured log file monitoring it worked only on that day till 11:59PM and then no events are getting indexed. Please recommend.

In splunkd.log have been getting the message.

06-25-2018 17:12:21.197 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/amz/xyz/logs/sap/prod1/cbc/xyz_3.0.log-2018.05.11.gz'.
06-25-2018 17:12:31.201 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/amz/xyz/logs/sap/prod1/cbc/xyz_3.0.log-2018.05.11.gz'.

Inputs.conf

[monitor:///opt/amz/xyz/logs/sap/prod1/cbc/xyz_3.0.log-*]
whitelist = OrderFulfillment_3.0.log-\d{4}.\d{2}.\d{2}
disabled = false
index = main
sourcetype = sap
initCrcLength = 256

[pruthvikrishnap]

Hi Satya,
This may be because Splunk was not able to read the correct timestamp in the file, sometimes it's thinking them as dd/mm/yyyy and sometimes as mm/dd/yyyy, please go through the doc below.

https://docs.splunk.com/Documentation/SplunkCloud/7.0.0/Data/Configuretimestamprecognition#Enhanced_...

Let me know if it works.

[frankwayne]

Can you provide an example of the events that are not getting indexed, especially the timestamps?

[MuS]

... worked only on that day til 11:59pm ...

sounds like this is related to a log rotate happening then. Might be worth reading this first http://docs.splunk.com/Documentation/Splunk/latest/Data/Howlogfilerotationishandled and afterwards this answer https://answers.splunk.com/answers/185453/why-copytruncate-logrotate-does-not-play-well-with.html

cheers, MuS