Hi All, I have a deployment app which successfully deployed to a server with the splunk forwarder installed, but which fails to process the files I want. My /opt/splunkforwarder/etc/apps/TA-VPS_Inputs_Reconciliation/default/input.conf contains the following. There is no inputs.conf in ../local/ (sst)[splunk@myserver default]$ more inputs.conf
# Reconciliaiton Report csv written by Incentage
#
# For report csv files. Using batch input to ensure processed files are deleted
[batch:///opt/incentage/dev/components/data/jsonConvToReconciliation/reconciliationreports/*.csv]
move_policy = sinkhole
index = dev_reconciliation
sourcetype = reconciliation:report
[batch:///opt/incentage/uat/components1/data/jsonConvToReconciliation/reconciliationreports/*.csv]
move_policy = sinkhole
index = uat_reconciliation
sourcetype = reconciliation:report The splunk user can see and delete the *.files under the input directory. but the files are not being processed. (sst)[splunk@myserver default]$ ls -la /opt/incentage/dev/components/data/jsonConvToReconciliation/reconciliationreports/*.csv
-rw-rw-r--. 1 imsadm imsadm 1872 Mar 21 14:28 /opt/incentage/dev/components/data/jsonConvToReconciliation/reconciliationreports/2021032114284000005.csv
-rw-rw-r--. 1 imsadm imsadm 1872 Mar 21 15:21 /opt/incentage/dev/components/data/jsonConvToReconciliation/reconciliationreports/2021032114284000006.csv I have no errors or warnings in the splunkd.log but see that the autodeployment worked. I also tried changing from batch:// to monitor:// with no luck (I commented the move_policy= line) I have also tried changing the input path to not include the wildcard *.csv Any ideas where to look?
... View more