We have a long standing batch input that has stopped working. No matter how i change the input including pointing the input directly at a singe file, nothing changes. Any way to get more information? Right now I have no information about why the files are not being ingested anymore. Can I change a logging config to get more info?
I have cleared the fishbucket with no changes. We are using the 7.3.3 UF.
I do notice more latency when i ls the file. Could the shared file system be too slow?
I am baffled so any ideas are more than welcome.
Thanks!
i turned the debug logs on but that just confirmed Splunk is ignoring the files even though the paths are present in list monitor. Just opened a case. Thanks
Hi @ebaileytu
There could be several possibilities,
See file tail processor state command -