Getting Data In

WARN FileClassifierManager: The file is invalid. Reason: cannot_open

leticiamartello
New Member

I have a watched file on a Universal Forwarder (Windows) and the file is send to the Heavy Forwarder (linux), but some file are not indexed, and some are indexed. This is the configuration on inputs.conf (Heavy Forwarder):

[monitor://D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O0055xxxxx_xxxxxx_*.CSV]
index=index_xxx
source=ccc:ccc
sourcetype=ccc:ccc
disabled = 0
time_before_close = 60
multiline_event_extra_waittime = true
initCrcLength = 512

I'm getting these errors:

11/1/19 7:33:12.398 PM11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - The file 'D:\Dados\xx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O0055xxxx_xxxx_20191101190001.CSV' is invalid. Reason: cannot_open
host = xxxx  index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/19 7:33:12.398 PM 11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - Unable to open 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV'. host = xxxx index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/197:33:12.398 PM 11-01-2019 19:33:12.398 -0300 ERROR TailReader - error from read call from 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV'. host = SRVCNFS02index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/19 7:33:12.398 PM  11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - The file 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV' is invalid. Reason: cannot_open
host = xxxx index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/19 7:33:12.398 PM 11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - Unable to open 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV'.

Does anyone know what is wrong?

Thnak you!

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Splunk cannot read the file because it does not have the required permissions.
Though I'm not a Windows guru (far from it), this is similar to Splunk running as the "splunk" user, and trying to monitor files owned by root.
Change the ownership or privileges on the directory, or change the account that Splunk itself runs as.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

corey_dick
Path Finder

I'm having the same issue.  I double checked and the account that Splunk is running under has Full Control of both the file and the folder.

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...