Splunk forwarder not processing batch input

[cku1]

Hi All,

I have a deployment app which successfully deployed to a server with the splunk forwarder installed, but which fails to process the files I want.

My /opt/splunkforwarder/etc/apps/TA-VPS_Inputs_Reconciliation/default/input.conf contains the following. There is no inputs.conf in ../local/

(sst)[splunk@myserver default]$ more inputs.conf
# Reconciliaiton Report csv written by Incentage
#

# For report csv files. Using batch input to ensure processed files are deleted
[batch:///opt/incentage/dev/components/data/jsonConvToReconciliation/reconciliationreports/*.csv]
move_policy = sinkhole
index = dev_reconciliation
sourcetype = reconciliation:report

[batch:///opt/incentage/uat/components1/data/jsonConvToReconciliation/reconciliationreports/*.csv]
move_policy = sinkhole
index = uat_reconciliation
sourcetype = reconciliation:report

The splunk user can see and delete the *.files under the input directory. but the files are not being processed.

(sst)[splunk@myserver default]$ ls -la /opt/incentage/dev/components/data/jsonConvToReconciliation/reconciliationreports/*.csv
-rw-rw-r--. 1 imsadm imsadm 1872 Mar 21 14:28 /opt/incentage/dev/components/data/jsonConvToReconciliation/reconciliationreports/2021032114284000005.csv
-rw-rw-r--. 1 imsadm imsadm 1872 Mar 21 15:21 /opt/incentage/dev/components/data/jsonConvToReconciliation/reconciliationreports/2021032114284000006.csv

I have no errors or warnings in the splunkd.log but see that the autodeployment worked.

I also tried changing from batch:// to monitor:// with no luck (I commented the move_policy= line)
I have also tried changing the input path to not include the wildcard *.csv

Any ideas where to look?

[richgalloway · Accepted solution]

Did you restart the forwarder after deploying the new inputs.conf file?

[cku1]

Thank you kind Sir!

Just what I needed to hear. I thought that would happen automatically as I saw in the log that the new App was being downloaded from the deploy server, and installed. However I have now checked the app settings on the server and see that the restart option is not enabled.

I've restarted the service now (On the server where the splunk forwarder is installed

> sudo su - splunk

> cd bin/

> ./splunk restart