Splunk Search

File too small....but not

caphrim007
Path Finder

I have these info messages popping up in my splunk install every couple of seconds

09-25-2012 09:37:40.378 -0500 INFO  WatchedFile - File too small to check seekcrc, probably truncated.  Will re-read entire file='/logging/syslog-ng/everything'.
09-25-2012 09:37:40.378 -0500 INFO  WatchedFile - Will begin reading at offset=0 for file='/logging/syslog-ng/everything'.

But the file that it is monitoring is growing nicely. Sooooo why?

Is it really re-reading the file every couple of seconds? It's a huge file; 14 gig+

Running splunk 4.3.4.

Tags (1)

metalon
New Member

Hi,

Same issue here.
Same error message, on a file that is 4Go+.

Any idea ?

Running splunk 4.3.2

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...