Getting Data In

How to find status of files being monitored?

wdsjon
Engager

Is there a command or somewhere to look regarding the status of file monitoring? I've set up a UF on an rsyslog machine with tons or currently residing text log files in nested directories that I've created a monitoring stanza for in an inputs.conf. Question - Is there a way from the universal forwarder to see the status of the files it's reading? I've been able to get sort of an idea with lsof , but some of the files are 50GB+. Thanks!

1 Solution

jnussbaum_splun
Splunk Employee
Splunk Employee
$SPLUNK_HOME/bin/splunk _internal call /services/admin/inputstatus/TailingProcessor:FileStatus

should get you done.

View solution in original post

jnussbaum_splun
Splunk Employee
Splunk Employee
$SPLUNK_HOME/bin/splunk _internal call /services/admin/inputstatus/TailingProcessor:FileStatus

should get you done.

robertlynch2020
Motivator

Sorry i am gettign this when i do that

 

bash$ splunk _internal call /services/admin/inputstatus/TailingProcessor:FileStatus
QUERYING: 'https://127.0.0.1:9089/services/admin/inputstatus/TailingProcessor:FileStatus'
This command [GET /services/admin/inputstatus/TailingProcessor:FileStatus] needs splunkd to be up, and splunkd is down.
dell425srv autoengine /dell425srv3/apps/AMBER_FWD/splunkforwarder_AMBER_PSC47_SEC1/splunkforwarder/bin/
bash$

0 Karma

martin_mueller
SplunkTrust
SplunkTrust
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...