Getting Data In

Why does Splunk 'lose interest' in files that are infrequently written to?

timrich66
Communicator

In our non-prod environment, some files are not written to on a regular basis.  In these cases the UF often needs to be restarted to start the ingestion of events.

The monitor stanza in use is very basic and does not have an 'ignoreOlderThan' value set.

Here is an example - 

[monitor:///my_non_prod_path/Log/app.log]
index=my_non_prod_index
sourcetype = nonprd_sourcetype
disabled=false

Are there global variables that would override this and cause events to not be ingested?

Thanks

 

Labels (2)
0 Karma
1 Solution

thambisetty
Super Champion

there are so many reasons for not reading file using monitor input.

worth reading below:

https://wiki.splunk.com/Community:Troubleshooting_Monitor_Inputs

————————————
If this helps, give a like below.

View solution in original post

thambisetty
Super Champion

there are so many reasons for not reading file using monitor input.

worth reading below:

https://wiki.splunk.com/Community:Troubleshooting_Monitor_Inputs

————————————
If this helps, give a like below.

View solution in original post

timrich66
Communicator

Thanks for the link.  It makes interesting reading.  I have asked our unix SA to add debugging to the UF so I can get more details.

Events from different files on the server in question are being ingested and the same file name on a different server is also providing events.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!