Getting Data In

issue with batch input that has stopped working

ebaileytu
Communicator

We have a long standing batch input that has stopped working. No matter how i change the input including pointing the input directly at a singe file, nothing changes. Any way to get more information? Right now I have no information about why the files are not being ingested anymore. Can I change a logging config to get more info? 

I have cleared the fishbucket with no changes. We are using the 7.3.3 UF.

I do notice more latency when i ls the file. Could the shared file system be too slow? 

I am baffled so any ideas are more than welcome. 

Thanks!

Labels (2)
Tags (3)
0 Karma

ebaileytu
Communicator

i turned the debug logs on but that just confirmed Splunk is ignoring the files even though the paths are present in list monitor. Just opened a case.  Thanks

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @ebaileytu 

There could be several possibilities,

  • check _internal index, splunkd sourcetype for any errors
  • ./splunk list monitor to find what files being monitored, make sure files having enough read permissions for splunk uf to read
  • Enable these debug flags if required - Community:Troubleshooting Monitor Inputs - Splunk Wiki

See file tail processor state command - 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...