Getting Data In
Highlighted

Log files not indexing.

Explorer

When I configured log file monitoring it worked only on that day till 11:59PM and then no events are getting indexed. Please recommend.

In splunkd.log have been getting the message.

06-25-2018 17:12:21.197 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/amz/xyz/logs/sap/prod1/cbc/xyz3.0.log-2018.05.11.gz'.
06-25-2018 17:12:31.201 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/amz/xyz/logs/sap/prod1/cbc/xyz
3.0.log-2018.05.11.gz'.

Inputs.conf

[monitor:///opt/amz/xyz/logs/sap/prod1/cbc/xyz3.0.log-*]
whitelist = OrderFulfillment
3.0.log-\d{4}.\d{2}.\d{2}
disabled = false
index = main
sourcetype = sap
initCrcLength = 256

0 Karma
Highlighted

Re: Log files not indexing.

Path Finder

Can you provide an example of the events that are not getting indexed, especially the timestamps?

0 Karma
Highlighted

Re: Log files not indexing.

SplunkTrust
SplunkTrust

... worked only on that day til 11:59pm ...

sounds like this is related to a log rotate happening then. Might be worth reading this first http://docs.splunk.com/Documentation/Splunk/latest/Data/Howlogfilerotationishandled and afterwards this answer https://answers.splunk.com/answers/185453/why-copytruncate-logrotate-does-not-play-well-with.html

cheers, MuS

0 Karma
Highlighted

Re: Log files not indexing.

Contributor

Hi Satya,
This may be because Splunk was not able to read the correct timestamp in the file, sometimes it's thinking them as dd/mm/yyyy and sometimes as mm/dd/yyyy, please go through the doc below.

https://docs.splunk.com/Documentation/SplunkCloud/7.0.0/Data/Configuretimestamprecognition#Enhanced_...

Let me know if it works.

0 Karma