When I configured log file monitoring it worked only on that day till 11:59PM and then no events are getting indexed. Please recommend.
In splunkd.log have been getting the message.
06-25-2018 17:12:21.197 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/amz/xyz/logs/sap/prod1/cbc/xyz_3.0.log-2018.05.11.gz'.
06-25-2018 17:12:31.201 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/amz/xyz/logs/sap/prod1/cbc/xyz_3.0.log-2018.05.11.gz'.
Inputs.conf
[monitor:///opt/amz/xyz/logs/sap/prod1/cbc/xyz_3.0.log-*]
whitelist = OrderFulfillment_3.0.log-\d{4}.\d{2}.\d{2}
disabled = false
index = main
sourcetype = sap
initCrcLength = 256
Hi Satya,
This may be because Splunk was not able to read the correct timestamp in the file, sometimes it's thinking them as dd/mm/yyyy and sometimes as mm/dd/yyyy, please go through the doc below.
Let me know if it works.
Can you provide an example of the events that are not getting indexed, especially the timestamps?
... worked only on that day til 11:59pm ...
sounds like this is related to a log rotate happening then. Might be worth reading this first http://docs.splunk.com/Documentation/Splunk/latest/Data/Howlogfilerotationishandled and afterwards this answer https://answers.splunk.com/answers/185453/why-copytruncate-logrotate-does-not-play-well-with.html
cheers, MuS