Splunk Search

Frequency lea updates pointer file

sdwilkerson
Contributor

Hello,

Does anyone know the frequency that the lea-loggrabber-splunk app's lea_loggrabber process should write to its record-number cache lea_log_rec_num.cache?

It seems that when Splunk is restarted or if lea_loggrabber is HUPd that this pointer file is not written to so next time the process starts, it gets lots of old data.

Also, a side note, is that because this pointer file is written to locally, you CANNOT use Splunk's Deployment Server to push this app since it will over write this record at each deployment/restart.

Thanks,

Sean

0 Karma
1 Solution

sdwilkerson
Contributor

Answering my own post here.
From what I can tell, the lea_log_rec_num.cache file only gets updated upon completion of the script run, meaning, the lea-connector has reached the end of the Checkpoint log file.

Therefore, in a high-volume environment, it could take a long time for this script to finish its initial run.

Sean

View solution in original post

sdwilkerson
Contributor

Answering my own post here.
From what I can tell, the lea_log_rec_num.cache file only gets updated upon completion of the script run, meaning, the lea-connector has reached the end of the Checkpoint log file.

Therefore, in a high-volume environment, it could take a long time for this script to finish its initial run.

Sean

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...