Monitoring Splunk

Why is splunk list inputstatus command showing files that have been deleted as still being monitored?

techols
New Member

We are using the UF to monitor multiple files which are to be considered transient.  All we want to do is get them forwarded then remove them.  We are using the splunk list inputstatus command to verify files have been forwarded, but even after removing them from the monitored location, the files still show as been open for reading using the inputstatus command. 

How long should it take for the UF to recognize the file is no longer present and should no longer to be monitored?

Is there a way to explicitly remove a file from being monitored without needing to restart the UF or add files to the blacklist?  I see there is a remove operation under https://<server>:<port>/services/admin//monitor.  What does that do?

Labels (2)
0 Karma

FrankVl
Ultra Champion

That's a good question. Had a quick look at my lab environment and there I also see files from years ago, that have long since been deleted, still listed as "open file", but with percent=100 and the file position equal to the file size (others are listed as "finished reading).

To some extent I would say this is how the whole 'fishbucket' stuff works, where splunk keeps track of which files it has been reading from and how far it got etc. But why it lists long deleted files still as "open file" is also beyond me...

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...