Splunk adds .filepart to file name

[AlexMcDuffMille]

Hello,

I put about 500 files on a server (between 2 directories) and was looking through the data. It seemed that most of the files were broken up line by line, but some of the files were not broken up and were saved as single events with multiple lines. Also, the source for some of the events were changed from the original file name (example1.log) to filename.filepart (example1.log.filepart).

Does anyone know what the .filepart means?

Thanks!

[Ayn · Accepted solution]

This is not due to anything Splunk does, but more likely because you've used some kind of file transfer software to transfer files to a directory Splunk is monitoring. WinSCP for instance will do this - while the file is transferred it will be called <filename>.filepart, then when the transfer is complete the file will be renamed to the original filename. Splunk will however pick up data directly when it appears, that is, before the file transfer is complete, and so will pull data while the file is still called <filename>.filepart.

[Ayn]

Sure, you can use blacklists in inputs.conf. Have a look at the docs: http://docs.splunk.com/Documentation/Splunk/6.0/admin/inputsconf

So for instance

[monitor:///some/directory]
blacklist = \.filepart$

[AlexMcDuffMille]

Is there anyway to prevent this from happening? I guess in the future I'll be sure to make sure it's uploaded before changing my inputs.conf to include the directory.