TailReader: TailReader [260668 tailreader0] - Batch input finished

[raiqb01]

HI 
in splunkd.log file I am seeing:

TailReader [260668 tailreader0] - Batch input finished reading file='/opt/splunkforwarder/var/spool/splunk/tracker.log'

and In splunk, I am seeing the logs as well

raiqb01_0-1723119942777.png

Basically, I want to know that is happening here.

this tracker.log file should be under index=_internal but somehow this file is present under index=linux  and in Linux TA, I can see the [linux_audit] sourcetype config under props.conf. 
who is calling this as I am not seeing any related input parameter for this.

Kind Regards,

Rashid

[isoutamo]

Hi
When you are looking source, it said that this event is from OS auditd not from Splunk’s internal logs. This is the reason why it is in your Linux index.
r. Ismo