Hi did you resolve this problem?  now i also run out it, i cannot parse these data  ... View more

Can we consider using socket packages and using the correct "try except" and timeout for filtering, which may be faster? Alternatively, asynchrony can be used, but most importantly, each event must have a timestamp ... View more

I guess you don't have permission of root directory of C drive, because it's worked when you place file into "C:\Program Files",  just check if you can create the new file (instead of folder) in roo directory of C drive. I guess you should only have permission to create folders now. ... View more

Hi  @gcusello  thanks for your answer, but I can‘t control delayed the rotation, due to those log file not managed by us, so if it's possible，adjusting from the Splunk side would be great. so as you said, "you can delay the rotation (30/60 seconds are sufficient) so Splunk will read also the last event in the file",  according to this, i found there is a parameter in inputs.conf, "time_before_close", it's 3 by default,  can i adjust this value so as to delay UF close monitored files？for example, set it as 30? thanks so much. \Zane ... View more

i have set this method, but it's still not working.     let me explain my sitution as below. I need to monitor the folders obtained by mounting Azure's "file share" (like pvc-xxxx), and the log generation policy as i mentioned before,  it will generate new folder named today's date,  /mnt/xxx/2023-09-20 /mnt/xxx/2023-09-21 ....   and the log naming policy is  /mnt/xxx/2023-09-20/open-development-abcd.log /mnt/xxx/2023-09-20/open-development-efgh.log /mnt/xxx/2023-09-21/open-development-abcd.log /mnt/xxx/2023-09-21/open-development-efgh.log the log name is same, but the content is differernt,  and then, it always stall ingest data at next day,  and i need to restart it, and then, the data will be collected, today 2023-09-21, i try to place some test file in 2023-09-21 folder by manully before restart , looks like the UF unable to detect them, so i restart it finally, the data was collected.  my input as below: [monitor://mnt/xxx/*/open-development*.log] disabled=0 host=xxxx index=xxx soucetype=xxx _TCP_ROUTING=xxx crcSalt=<SOURCE>   please help try to locate the root cause, thanks so much. please ... View more

I ask this question  because i occured a issues about UF collection, i have some floder named as date, for example, date is 2023-08-31, and then the log file will be placed here, and so on,  but the log file name may same，but the content is different,  and then i found there is a so strange phenomena, Collecting data always stops the previous day，for example, today is 2023-09-01, it stop at yesterday 2023-08-31, It will not collect the logs generated today， the file names in these two folders are the same, but the content，size，modified time is different, and I have also added the crcSalt parameter , and it will collect data again after i restart UF,  it cycles this phenomenon every day until I restart.  so is there any parameter for this? thanks so much.   my inputs as below: [monitor:///mnt/business/pvc-6e1ed89e/privopen/*/open-test*.log] disabled = 0 host = myhost index = test_index crcSalt=<SOURCE> sourcetype = test_business _TCP_ROUTING=azure_hf       ... View more

is there any resolution?  ... View more

Hi there， i'm a new splunker I'd like to know what's means of these search result, such as "management", "default-autolb-group:xxx.xxx.xxx.xxx:9997:3:1" i can understand there is my HF ip and port, but what's means of :3:1, I have seen :0:0, :0:1.... thanks in advance. @woodcock  ... View more

is there a solution to fix this? my version already upgrade to 9.0.3.  can i modify the limits.conf to limit thrput? ... View more