Splunk Search

File too small....but not

caphrim007
Path Finder

I have these info messages popping up in my splunk install every couple of seconds

09-25-2012 09:37:40.378 -0500 INFO  WatchedFile - File too small to check seekcrc, probably truncated.  Will re-read entire file='/logging/syslog-ng/everything'.
09-25-2012 09:37:40.378 -0500 INFO  WatchedFile - Will begin reading at offset=0 for file='/logging/syslog-ng/everything'.

But the file that it is monitoring is growing nicely. Sooooo why?

Is it really re-reading the file every couple of seconds? It's a huge file; 14 gig+

Running splunk 4.3.4.

Tags (1)

metalon
New Member

Hi,

Same issue here.
Same error message, on a file that is 4Go+.

Any idea ?

Running splunk 4.3.2

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...