Getting Data In

issue with batch input that has stopped working

ebaileytu
Communicator

We have a long standing batch input that has stopped working. No matter how i change the input including pointing the input directly at a singe file, nothing changes. Any way to get more information? Right now I have no information about why the files are not being ingested anymore. Can I change a logging config to get more info? 

I have cleared the fishbucket with no changes. We are using the 7.3.3 UF.

I do notice more latency when i ls the file. Could the shared file system be too slow? 

I am baffled so any ideas are more than welcome. 

Thanks!

Labels (2)
Tags (3)
0 Karma

ebaileytu
Communicator

i turned the debug logs on but that just confirmed Splunk is ignoring the files even though the paths are present in list monitor. Just opened a case.  Thanks

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @ebaileytu 

There could be several possibilities,

  • check _internal index, splunkd sourcetype for any errors
  • ./splunk list monitor to find what files being monitored, make sure files having enough read permissions for splunk uf to read
  • Enable these debug flags if required - Community:Troubleshooting Monitor Inputs - Splunk Wiki

See file tail processor state command - 

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...