Getting Data In

Batch not indexing previously locked file

joonradley
Path Finder

Hi,

I have a problem where batch input will not index files that was locked when Splunk first tried to index the file.

The splunkd.log shows the following entries:

02-20-2012 21:15:43.145 +0200 WARN TailingProcessor - Will retry file='c:\data\data_20120220211543083.log' in 10000ms due to: The process cannot access the file because it is being used by another process.

02-20-2012 21:15:53.005 +0200 ERROR TailingProcessor - Ignoring path due to: failed to open for checksum: 'c:\data\data_20120220211543083.log' (The process cannot access the file because it is being used by another process.)

The file remains in the directory even after it is no longer locked and no further entries are found in splunkd.log for the file 12 hours after the initial entries.

Other files that are not locked get indexed and deleted.

How can I get Splunk to index the previously locked files?

inputs.conf
[batch://c:\data]
sourcetype=AuditData
move_policy = sinkhole
crcSalt =

System: Windows 2008 R2 64-bit, Splunk 4.2.4

Thx

Joon

Tags (2)
0 Karma

NiklasB
Explorer
0 Karma

MarioM
Motivator

did you try moving the file into a subdirectory?

MarioM
Motivator

I am not in batch mode locked files can be indexed if they are being used by another process...I know it does when on monitor mode

0 Karma

joonradley
Path Finder

Thx, moving the files got them indexed, but it does not solve the underlying issue. The locked files do not get indexed.

Any ideas on that?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...