Splunkd monitoring and getting stopped by itself

[kannu]

Hi guys,

I have came across a new problem and want to ask one question on how the splunkd process is running.

Let us suppose i am monitoring a file and forwarding the data from splunk forwarder to my search head.

Mean while the file which is being monitored has no new data from past seven hour so what splunkd process will do , will it keep monitoring the file in real time or it will go in ideal/shut down state and become active only if my file monitored got appended with new logs.

[mattymo · Accepted solution]

Hey kannu,

Splunk will continue to check on the file at an interval and ingest changes when necessary.

Find more info on that here http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories#How_the_monitor_p...

and here:

https://www.splunk.com/blog/2008/08/14/what-is-this-fishbucket-thing.html

[kannu]

Thank you for your reply,
But i have checked the links your provided but i didnt find any suitable answer for my query

[mattymo]

Splunk will monitor the file continuously. It does not sleep or back off. It will check over and over again until the checksum or seekptr doesnt match then it will start ingesting the new data. The documentation provides more indepth details about how Splunk's monitor process and fishbucket work in that process.