WARN FileClassifierManager: The file is invalid. Reason: cannot_open

[leticiamartello]

I have a watched file on a Universal Forwarder (Windows) and the file is send to the Heavy Forwarder (linux), but some file are not indexed, and some are indexed. This is the configuration on inputs.conf (Heavy Forwarder):

[monitor://D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O0055xxxxx_xxxxxx_*.CSV]
index=index_xxx
source=ccc:ccc
sourcetype=ccc:ccc
disabled = 0
time_before_close = 60
multiline_event_extra_waittime = true
initCrcLength = 512

I'm getting these errors:

11/1/19 7:33:12.398 PM11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - The file 'D:\Dados\xx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O0055xxxx_xxxx_20191101190001.CSV' is invalid. Reason: cannot_open
host = xxxx  index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/19 7:33:12.398 PM 11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - Unable to open 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV'. host = xxxx index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/197:33:12.398 PM 11-01-2019 19:33:12.398 -0300 ERROR TailReader - error from read call from 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV'. host = SRVCNFS02index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/19 7:33:12.398 PM  11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - The file 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV' is invalid. Reason: cannot_open
host = xxxx index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/19 7:33:12.398 PM 11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - Unable to open 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV'.

Does anyone know what is wrong?

Thnak you!

[codebuilder]

Splunk cannot read the file because it does not have the required permissions.
Though I'm not a Windows guru (far from it), this is similar to Splunk running as the "splunk" user, and trying to monitor files owned by root.
Change the ownership or privileges on the directory, or change the account that Splunk itself runs as.

[corey_dick]

I'm having the same issue.  I double checked and the account that Splunk is running under has Full Control of both the file and the folder.