I've got this little file Oracle appends a row to every hour, and it stopped being monitored mysteriously sometime around the last logrotate (near as I can tell). Now it's not updating, or updating haphazardly. Here's what the file looks like:
10-01-12:08:47:02, 0, 0, 2, 6, 106, 2
10-01-12:08:48:01, 0, 0, 2, 6, 106, 2
10-01-12:08:49:01, 0, 0, 2, 6, 106, 2
Heady stuff, I know. Anyhow, Splunk was indexing that file well enough and now it isn't. Currently, my inputs.conf stanza for it looks like this:
recursive = true
I've tried crcSalt to no avail. I even tried to disable followTail but in the log it said TailingProcessor: starting at offset whatever... and continued to not do what I wanted.
Is there a way to "reset" the entries resulting from this stanza and force a re-index? And why did it die?
The short answer is: do not use followTail=1: