Splunk Forwarder Not Sending Updates in Text File

[erick4x4]

I use Splunk to monitor a basic text file on multiple Windows Servers with the following stanza in inputs.conf:

[monitor://C:\Windows\System32\logfiles\Ansible.log]
disabled = 0
sourcetype = Ansible
index = sw
interval = 10

This always works at first and I can find all the events inside Splunk. But that Ansible.log file is regularly updated by Powershell or ScheduledTask or something similar and over time several servers will have 0 events for that Ansible.log file. In the file system, the file has been updated recently, but the Splunk Universal Forwarder just doesn't sent the updates but those servers have events from other SourceTypes. Restarting the SplunkForwarder service, the server, upgrading the Splunk Universal Forwarder does not fix the issue. The file is a simple raw text file in (typically UTF8 but I've tried multiple formats). I've make sure permissions are correct and the service which runs the SplunkForwarder has read rights.

What else can I do to have the SplunkForwarder send updates to that file?

[gcusello · Accepted solution]

Hi @erick4x4 ,

Splunk, by default, doesn't index twice the same logs, so, if this file is always the same or it has the same first 256 chars, it isn't read.

For more infos see at https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/Inputsconf searhcing for crcSalt.

Anyway, you could use a larger initCrcLenght parameter to check more than the first 256 chars, or write the file with a different name (e.g. including date and/or time) and using crcSalt = <SOURCE> parameter.

Ciao.

Giuseppe

[erick4x4]

Gcusello,

This is exactly what's going on. That log file is updated frequently but its by a script which 99% of the time writes the identical output (when it doesn't detect any problems). That means Windows shows the file has a new update timestamp, but the file hash doesn't actually change. I'll edit my script to put a dynamic timestamp in the file or something to make the content change so the Splunk Forwarder sends the changes.

Thank you so much!

[gcusello]

Hi @erick4x4 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉