Hi everyone, I want to monitor files on a Linux server. Every hours (at minute 59), a file DATE.log is compressed into a DATE.gz. Though inputs.conf I am monitoring all the files (DATE*). I noticed that I have some logs missing for 20 minutes (from ~ the minute 37 to the minute 59) every hours between 8am to 8pm. I checked the splunkd.log and saw this error: WARN TailReader - Insufficient permissions to read file='.../DATE.gz' (hint: Permission denied) I gave reading rights on the .gz files, but maybe it's not enough as the decompression is effective on the forwarder. Should I give writing rights to my splunk user on these files? Not sure if it's gonna fix the missing logs problem but I will start with that ^^ Have a good day, ... View more