Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- inputs.conf wait time t monitor file
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I am running into an issue where the 6.5.3 UF does not wait long enough on the monitored file as the file sometimes takes 400 secs to fully have been reported upon and close.
Looking at the inputs.conf man page I notice "followTail" and "time_before_close" configurations.
Could someone shed some light as to what "time_before_close = " really does?
Will this "time_before_close = " configuration set the the UF to wait until my specified time to read the file in its entirety?
Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
rbardonetorian,
"time_before_close" Will cause Splunk to wait a specified amount of time after Splunk has reach an EOF condition. The default of 3 seconds can be too low on systems buffering their writes or very heavily loaded systems. That will cause Splunk to truncate events.
Another option that will help is "multiline_event_extra_waittime = true". I'd recommend using this setting in combination with "time_before_close".
Between these two settings, Splunk will wait longer for writes to happen when they're "mid event" and that will reduce event truncation significantly.
Some draw-backs of "time_before_close" are that Splunk will use extra file descriptors as it is keeping more files open longer.
Lastly, don't use "followTail" unless instructed to do so by support. It doesn't sound like it will help in your situation and will likely cause more issues than it solves.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
rbardonetorian,
"time_before_close" Will cause Splunk to wait a specified amount of time after Splunk has reach an EOF condition. The default of 3 seconds can be too low on systems buffering their writes or very heavily loaded systems. That will cause Splunk to truncate events.
Another option that will help is "multiline_event_extra_waittime = true". I'd recommend using this setting in combination with "time_before_close".
Between these two settings, Splunk will wait longer for writes to happen when they're "mid event" and that will reduce event truncation significantly.
Some draw-backs of "time_before_close" are that Splunk will use extra file descriptors as it is keeping more files open longer.
Lastly, don't use "followTail" unless instructed to do so by support. It doesn't sound like it will help in your situation and will likely cause more issues than it solves.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Perfect , thank you!!
Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside
Splunk App Dev Community Updates – What’s New and What’s Next
The Latest Cisco Integrations With Splunk Platform!
