Getting Data In

Why is a text file with only one number not continuously read in Splunk 6.4.1 with my current inputs.conf?

Path Finder


I have set up batch files to count the number of documents in a folder. Splunk is running this batch file successfully every 60 seconds (this is working since I see it from the timestamp of the text files).

I have set it up as follows in my app's inputs.conf:

[monitor://D:\OT System Monitoring\countLivelinkToAdlib.txt]
disabled = false
index = otcs
interval = 60
sourcetype = OtcsAdlibCountsLivelinkAdlib
host = bbmag88
followTail = 0
initCrcLength = 512

disabled = false
interval = 60

When I check my index/ sourcetype, I can see that the data is not coming in continuously (sometimes it is coming in, sometimes not). Since I have configured my panel to refresh every 60 seconds and only check for the value of the last 60 seconds, my panels sometimes do not show any data.

I have some log entries in my splunkd.log

06-30-2016 08:59:59.278 +0200 INFO  WatchedFile - Checksum for seekptr didn't match, will re-read entire file='D:\OT System Monitoring\counteSignToLES.txt'.
06-30-2016 08:59:59.278 +0200 INFO  WatchedFile - Will begin reading at offset=0 for file='D:\OT System Monitoring\counteSignToLES.txt'.

I guess that Splunk thinks that there is no change in the file (since sometimes the count is 0 for some time or the same value for some time).

Is there a way to fix this? I have already tried followTail and initCrCLength (see above).

Any ideas?


0 Karma


You can try to make it like this:

  1. your batch creates a file named with the time stamp instead of writing in the same file
  2. instead of using monitor you can use the batch:// stanza (which deletes the file after indexing)
  3. monitor (using batch) the folder where the files are created instead of monitoring a single file
  4. add crcSalt = <SOURCE> in the batch stanza

this way your batch creates a new file every time and the file named is also used for crc check, so its always different and is always index even if the value inside doesn't change.

Hope I was able to help you. If so, some karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...