Getting Data In

Splunk Forwarder preventing application from logging

ebuljan
New Member

Our Splunk Forwarder on Windows Server is monitoring 2 folders containing approximately 1k log files total. I am ignoring the vast majority of the files. Each log file is fairly large, and is constantly being written to. Each one contains a day's worth of data, about 24k lines of text when the day is over.

When the Splunk Forwarder is on, the application that logs to it seems to skip logging intermittent lines of text. When it is off, all lines are logged.

Our inputs.conf file is very sparse:

[monitor://C:\Data\Import\log\*.log]
ignoreOlderThan = 2d 

[monitor://C:\Data\Export\log\*.log]
ignoreOlderThan = 2d 

Any suggestions?

0 Karma

ebuljan
New Member

To clarify, Splunk is logging everything in the log files that it is monitoring, as expected.

But when the Splunk Forwarder is on, there are gaps in the log files.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Does this log file get written to the top (head) of the file, or appended to the end of the file?

Take a look at CRCSALT or or FollowTail options for inputs.conf.

See here : https://docs.splunk.com/Documentation/Splunk/7.1.1/Data/Howlogfilerotationishandled

0 Karma

ebuljan
New Member

Thanks for your response. They are being written to the bottom.

A new file with a new name is created every day, so it doesn't sound like the CRC or FollowTail options would help in this case: "Do not use followTail for rolling log files (log files that get renamed as they age)..."

0 Karma

MuS
Legend

It might be also worth to check for anti virus software doing things ....

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Any pertinent information in the Windows Application logs?

0 Karma

ebuljan
New Member

Nothing special in there

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...