Starting from splunk version 6.3 and later, you can use this command.
./splunk list inputstatus
It will return something like this.
Cooked:tcp :
9997:192.168.1.104:8089
time opened = 2017-07-09T17:28:47+0800
/opt/splunk/var/log/splunk/splunkd_ui_access.log
file position = 434781
file size = 434781
parent = $SPLUNK_HOME/var/log/splunk
percent = 100.00
type = finished reading
Here is the meaning of the output:
file position: The file pointer position that Splunk is currently reading at. If this is the same as file size, that means Splunk reach end of file (EOF).
file size : Total file size of the monitored file.
parent : If you are monitoring a directory, this tell you from which monitoring stanza the file is come from.
percent : The progress of the monitoring. If it is less than 100%, Splunk will re-visit the file again.
type: The monitoring status. It can be ‘finished reading’, ‘open file’, ‘missing’, ’directory’, 'reading (batch)'.
Remark: If you saw 'reading (batch)', that means the file that you are monitoring is greater than min_batch_size_bytes under limits.conf (default is 20M in size) and Splunk is using batch processor to process the file. It is a single thread process and will process one file at a time. (TailingProcessor is multi thread process).
... View more
