Getting Data In

ingesting huge file continuously

cleelakrishna
Loves-to-Learn

we have seen as issue where Splunk UF stops reading a specific file once file gets more than 20MB , and going to batch process ( which is waiting till file to complete)  ,  My file gets Realtime data and reaches >1GB in 3 hours. which splunk cannot read that huge file. Please provide the config settings that i need to change for Splunk to read continuously .

Labels (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @cleelakrishna 

Can you share the monitor stanza configured in inputs.conf and outputs conf on UF?

 

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...