Getting Data In

Windows Forwarder - Unable to rotate/delete log file. Handle open by splunkd.exe?

mcrawford44
Communicator

Has anyone run into this before? I'm unable to rotate logs due to files being opened by the forwarder. The files have not changed in several days. No new events, nothing. Shouldn't Splunk sleep or let go of the file?

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Maybe... though if you intend to delete the file very soon after it's been written and you have delayed forwarding, you may already be deleting it before the forwarder even starts to get a handle on the file.

As an alternative, you can see what happens if you set ignoreOlderThan=3d or something similar in inputs.conf - the forwarder might let go of the file entirely by then.

0 Karma

ddrillic
Ultra Champion
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Have you tried the special Windows-only [MonitorNoHandle://<path>] in inputs.conf?

0 Karma

mcrawford44
Communicator

Won't this allow deletion of a file that is not completely indexed yet?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...