Getting Data In

Splunk forwarder not processing batch input

cku1
Engager

Hi All,

I have a deployment app which successfully deployed to a server with the splunk forwarder installed, but which fails to process the files I want.

My /opt/splunkforwarder/etc/apps/TA-VPS_Inputs_Reconciliation/default/input.conf contains the following. There is no inputs.conf in ../local/

 

(sst)[splunk@myserver default]$ more inputs.conf
# Reconciliaiton Report csv written by Incentage
#

# For report csv files. Using batch input to ensure processed files are deleted
[batch:///opt/incentage/dev/components/data/jsonConvToReconciliation/reconciliationreports/*.csv]
move_policy = sinkhole
index = dev_reconciliation
sourcetype = reconciliation:report

[batch:///opt/incentage/uat/components1/data/jsonConvToReconciliation/reconciliationreports/*.csv]
move_policy = sinkhole
index = uat_reconciliation
sourcetype = reconciliation:report

 

 

The splunk user can see and delete the *.files under the input directory. but the files are not being processed.

 

(sst)[splunk@myserver default]$ ls -la /opt/incentage/dev/components/data/jsonConvToReconciliation/reconciliationreports/*.csv
-rw-rw-r--. 1 imsadm imsadm 1872 Mar 21 14:28 /opt/incentage/dev/components/data/jsonConvToReconciliation/reconciliationreports/2021032114284000005.csv
-rw-rw-r--. 1 imsadm imsadm 1872 Mar 21 15:21 /opt/incentage/dev/components/data/jsonConvToReconciliation/reconciliationreports/2021032114284000006.csv

 

 

I have no errors or warnings in the splunkd.log but see that the autodeployment worked.

I also tried changing from batch:// to monitor:// with no luck (I commented the move_policy= line)
I have also tried changing the input path to not include the wildcard *.csv

Any ideas where to look?

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Did you restart the forwarder after deploying the new inputs.conf file?

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you restart the forwarder after deploying the new inputs.conf file?

---
If this reply helps you, Karma would be appreciated.
0 Karma

cku1
Engager

Thank you kind Sir!

Just what I needed to hear. I thought that would happen automatically as I saw in the log that the new App was being downloaded from the deploy server, and installed. However I have now checked the app settings on the server and see that the restart option is not enabled.

I've restarted the service now (On the server where the splunk forwarder is installed

> sudo su - splunk

> cd bin/

> ./splunk restart

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...