file size impact continuous monitoring in splunk?

[rameshlpatel]

Hi, I have single file where I am writing all my logs and its size reached to 300 MB.

I am seeing that some logs that present in log file are not seeing in splunk.

Here my question is size of log file is impact anyway to splunk to monitor same file ?

[yannK]

Size should not impact, but will be a bit slower if you have many large files or zip files to monitor.

Do you see gaps in the logs, or do you see the file monitoring stopping ?

• Check in your splunkd.log if the file is not skipped for another reason (CRC identical to another file, or permission change)
• also search over all time for this source, in case the problem is that the timestamp of the events is missinterpreted (timezone, eventin the future, or event far in the past)

[rameshlpatel]

i am seeing some logs are not coming in splunk where its present in log file.

[lguinn2]

Did you check the splunkd.log file for error or warning messages?

[yannK]

Actually I heard of a bug at one point when the file size grows between the limit between the tailingprocessor (small files changing quickly) and the batchprocessor (large files not changing often).
Try to restart the forwarder and see if it cause the end of the file to be indexed.