Getting Data In

Windows Forwarder - Unable to rotate/delete log file. Handle open by splunkd.exe?

mcrawford44
Communicator

Has anyone run into this before? I'm unable to rotate logs due to files being opened by the forwarder. The files have not changed in several days. No new events, nothing. Shouldn't Splunk sleep or let go of the file?

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Maybe... though if you intend to delete the file very soon after it's been written and you have delayed forwarding, you may already be deleting it before the forwarder even starts to get a handle on the file.

As an alternative, you can see what happens if you set ignoreOlderThan=3d or something similar in inputs.conf - the forwarder might let go of the file entirely by then.

0 Karma

ddrillic
Ultra Champion
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Have you tried the special Windows-only [MonitorNoHandle://<path>] in inputs.conf?

0 Karma

mcrawford44
Communicator

Won't this allow deletion of a file that is not completely indexed yet?

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...