Why does Splunk 'lose interest' in files that are infrequently written to?

[timrich66]

In our non-prod environment, some files are not written to on a regular basis.  In these cases the UF often needs to be restarted to start the ingestion of events.

The monitor stanza in use is very basic and does not have an 'ignoreOlderThan' value set.

Here is an example - 

[monitor:///my_non_prod_path/Log/app.log]
index=my_non_prod_index
sourcetype = nonprd_sourcetype
disabled=false

Are there global variables that would override this and cause events to not be ingested?

Thanks

[thambisetty · Accepted solution]

there are so many reasons for not reading file using monitor input.

worth reading below:

https://wiki.splunk.com/Community:Troubleshooting_Monitor_Inputs

[timrich66]

Thanks for the link.  It makes interesting reading.  I have asked our unix SA to add debugging to the UF so I can get more details.

Events from different files on the server in question are being ingested and the same file name on a different server is also providing events.