Getting Data In

Splunk not indexing text file

osasfrancis
Path Finder

Hi all, i have a simple splunk app that monitors a folder and indexes a text file that is overwritten every hour. It works fine. Then all of a sudden, it just stops indexing, even as new files are created. Below are my configs. Any suggestion is appreciated

inputs.conf

[monitor://E:\Splunk\ccure\AllSites\*.txt]
sourcetype = ccure:allsite:csv
index = security
disabled = false

[monitor://E:\Splunk\ccure\Forced_Held\*.txt]
sourcetype = ccure:door_csv
index = security
disabled = false

props.conf
[ccure:allsite:csv]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
CHARSET=UTF-8
INDEXED_EXTRACTIONS=csv
KV_MODE=none
category=Structured
disabled=false
pulldown_type=true
CHECK_METHOD=modtime 

[ccure:door_csv]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
CHARSET=UTF-8
LINE_BREAKER=([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD=180
disabled=false
CHECK_METHOD=modtime
SEDCMD-crop_extra_line=s/(?!match)Door Forced Report - InfoSec(?!match)($|([\r\n]+))//g
TRANSFORMS-set=setnull

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @osasfrancis,

when did indexing stop?
if it happened from the 1st of the month, you should check the date format, because if it is in European format (dd / mm / yyyy) and you have not defined the TIME_FORMAT, Splunk interprets it with the American format (mm / dd / yyyy) .
The problem will be solved automatically from the 13th until the end of the month because there will be no more ambiguity.

Ciao.

Giuseppe

osasfrancis
Path Finder

Hi,

Thanks for your response. It stopped indexing 4/3/2021. And since then, the text file has been overwritten every hour with new contents, but for some reason, it is just not picking up the updated file. Also, the program creating the text file does not have the ability to give the file a new name everytime it generates it.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...