Getting Data In

issue with batch input that has stopped working

ebaileytu
Communicator

We have a long standing batch input that has stopped working. No matter how i change the input including pointing the input directly at a singe file, nothing changes. Any way to get more information? Right now I have no information about why the files are not being ingested anymore. Can I change a logging config to get more info? 

I have cleared the fishbucket with no changes. We are using the 7.3.3 UF.

I do notice more latency when i ls the file. Could the shared file system be too slow? 

I am baffled so any ideas are more than welcome. 

Thanks!

Labels (2)
Tags (3)
0 Karma

ebaileytu
Communicator

i turned the debug logs on but that just confirmed Splunk is ignoring the files even though the paths are present in list monitor. Just opened a case.  Thanks

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @ebaileytu 

There could be several possibilities,

  • check _internal index, splunkd sourcetype for any errors
  • ./splunk list monitor to find what files being monitored, make sure files having enough read permissions for splunk uf to read
  • Enable these debug flags if required - Community:Troubleshooting Monitor Inputs - Splunk Wiki

See file tail processor state command - 

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...