Monitoring Splunk

Splunkd monitoring and getting stopped by itself

kannu
Communicator

Hi guys,

I have came across a new problem and want to ask one question on how the splunkd process is running.

Let us suppose i am monitoring a file and forwarding the data from splunk forwarder to my search head.

Mean while the file which is being monitored has no new data from past seven hour so what splunkd process will do , will it keep monitoring the file in real time or it will go in ideal/shut down state and become active only if my file monitored got appended with new logs.

Tags (1)
0 Karma
1 Solution

mattymo
Splunk Employee
Splunk Employee

Hey kannu,

Splunk will continue to check on the file at an interval and ingest changes when necessary.

Find more info on that here http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories#How_the_monitor_p...

and here:

https://www.splunk.com/blog/2008/08/14/what-is-this-fishbucket-thing.html

- MattyMo

View solution in original post

0 Karma

mattymo
Splunk Employee
Splunk Employee

Hey kannu,

Splunk will continue to check on the file at an interval and ingest changes when necessary.

Find more info on that here http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories#How_the_monitor_p...

and here:

https://www.splunk.com/blog/2008/08/14/what-is-this-fishbucket-thing.html

- MattyMo
0 Karma

kannu
Communicator

Thank you for your reply,
But i have checked the links your provided but i didnt find any suitable answer for my query

0 Karma

mattymo
Splunk Employee
Splunk Employee

Splunk will monitor the file continuously. It does not sleep or back off. It will check over and over again until the checksum or seekptr doesnt match then it will start ingesting the new data. The documentation provides more indepth details about how Splunk's monitor process and fishbucket work in that process.

- MattyMo
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...