Why is Splunk not reading old data in a file?

[ankithnageshshe]

Hi Splunkers,

I recently ran into an issue where our Splunk forwarder is able to read and index the new lines in the file but not the old lines in the file that were written before configuring the monitoring.

Eg: I set monitor stanza at 3:00 pm for file abc.txt.....so any log that is written after 3:00 is indexed but logs before 3:00 are not indexed.

I tried again with crcSalt for no luck.

Any help is much appreciated.

Regards,
Ankith

[mstjohn_splunk]

hi @ankithnageshshetly

Did the answer below solve your problem? If so, please resolve this post by approving it!
If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

[MuS]

Hi ankithnageshshetty,

check the inputs.conf for the following option:

followTail = [0|1]
* Whether or not the input should skip past current data in a monitored file
  for a given input stanza. This lets you skip over data in files, and
  immediately begin indexing current data.

Defaults to 0 but if set to 1, Splunk will start monitoring at the end of the file - like a tail -f ...

Hope this helps ...

cheers, MuS