Getting Data In

Splunk not indexing text file

osasfrancis
Path Finder

Hi all, i have a simple splunk app that monitors a folder and indexes a text file that is overwritten every hour. It works fine. Then all of a sudden, it just stops indexing, even as new files are created. Below are my configs. Any suggestion is appreciated

inputs.conf

[monitor://E:\Splunk\ccure\AllSites\*.txt]
sourcetype = ccure:allsite:csv
index = security
disabled = false

[monitor://E:\Splunk\ccure\Forced_Held\*.txt]
sourcetype = ccure:door_csv
index = security
disabled = false

props.conf
[ccure:allsite:csv]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
CHARSET=UTF-8
INDEXED_EXTRACTIONS=csv
KV_MODE=none
category=Structured
disabled=false
pulldown_type=true
CHECK_METHOD=modtime 

[ccure:door_csv]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
CHARSET=UTF-8
LINE_BREAKER=([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD=180
disabled=false
CHECK_METHOD=modtime
SEDCMD-crop_extra_line=s/(?!match)Door Forced Report - InfoSec(?!match)($|([\r\n]+))//g
TRANSFORMS-set=setnull

Labels (1)
0 Karma

gcusello
Legend

Hi @osasfrancis,

when did indexing stop?
if it happened from the 1st of the month, you should check the date format, because if it is in European format (dd / mm / yyyy) and you have not defined the TIME_FORMAT, Splunk interprets it with the American format (mm / dd / yyyy) .
The problem will be solved automatically from the 13th until the end of the month because there will be no more ambiguity.

Ciao.

Giuseppe

osasfrancis
Path Finder

Hi,

Thanks for your response. It stopped indexing 4/3/2021. And since then, the text file has been overwritten every hour with new contents, but for some reason, it is just not picking up the updated file. Also, the program creating the text file does not have the ability to give the file a new name everytime it generates it.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...