Getting Data In

Splunk not indexing text file

osasfrancis
Path Finder

Hi all, i have a simple splunk app that monitors a folder and indexes a text file that is overwritten every hour. It works fine. Then all of a sudden, it just stops indexing, even as new files are created. Below are my configs. Any suggestion is appreciated

inputs.conf

[monitor://E:\Splunk\ccure\AllSites\*.txt]
sourcetype = ccure:allsite:csv
index = security
disabled = false

[monitor://E:\Splunk\ccure\Forced_Held\*.txt]
sourcetype = ccure:door_csv
index = security
disabled = false

props.conf
[ccure:allsite:csv]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
CHARSET=UTF-8
INDEXED_EXTRACTIONS=csv
KV_MODE=none
category=Structured
disabled=false
pulldown_type=true
CHECK_METHOD=modtime 

[ccure:door_csv]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
CHARSET=UTF-8
LINE_BREAKER=([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD=180
disabled=false
CHECK_METHOD=modtime
SEDCMD-crop_extra_line=s/(?!match)Door Forced Report - InfoSec(?!match)($|([\r\n]+))//g
TRANSFORMS-set=setnull

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @osasfrancis,

when did indexing stop?
if it happened from the 1st of the month, you should check the date format, because if it is in European format (dd / mm / yyyy) and you have not defined the TIME_FORMAT, Splunk interprets it with the American format (mm / dd / yyyy) .
The problem will be solved automatically from the 13th until the end of the month because there will be no more ambiguity.

Ciao.

Giuseppe

osasfrancis
Path Finder

Hi,

Thanks for your response. It stopped indexing 4/3/2021. And since then, the text file has been overwritten every hour with new contents, but for some reason, it is just not picking up the updated file. Also, the program creating the text file does not have the ability to give the file a new name everytime it generates it.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...