Getting Data In

WARN FileClassifierManager: The file is invalid. Reason: cannot_open

leticiamartello
New Member

I have a watched file on a Universal Forwarder (Windows) and the file is send to the Heavy Forwarder (linux), but some file are not indexed, and some are indexed. This is the configuration on inputs.conf (Heavy Forwarder):

[monitor://D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O0055xxxxx_xxxxxx_*.CSV]
index=index_xxx
source=ccc:ccc
sourcetype=ccc:ccc
disabled = 0
time_before_close = 60
multiline_event_extra_waittime = true
initCrcLength = 512

I'm getting these errors:

11/1/19 7:33:12.398 PM11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - The file 'D:\Dados\xx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O0055xxxx_xxxx_20191101190001.CSV' is invalid. Reason: cannot_open
host = xxxx  index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/19 7:33:12.398 PM 11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - Unable to open 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV'. host = xxxx index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/197:33:12.398 PM 11-01-2019 19:33:12.398 -0300 ERROR TailReader - error from read call from 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV'. host = SRVCNFS02index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/19 7:33:12.398 PM  11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - The file 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV' is invalid. Reason: cannot_open
host = xxxx index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/19 7:33:12.398 PM 11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - Unable to open 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV'.

Does anyone know what is wrong?

Thnak you!

0 Karma

codebuilder
Influencer

Splunk cannot read the file because it does not have the required permissions.
Though I'm not a Windows guru (far from it), this is similar to Splunk running as the "splunk" user, and trying to monitor files owned by root.
Change the ownership or privileges on the directory, or change the account that Splunk itself runs as.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

corey_dick
Path Finder

I'm having the same issue.  I double checked and the account that Splunk is running under has Full Control of both the file and the folder.

0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...