Hi,
I have been looking for information about REST API point to know if UF has completed reading the file and sending events to indexer, or simply waiting for events to be logged to monitored file:
/services/admin/inputstatus/TailingProcessor:FileStatus
I am trying to track if universal forwarder is reading files monitored or completed sending events.
some key shows type="open file", and others showing "finished reading".
Could anyone know the difference between "open file" and "finished reading"?
If there are more status for file input, I would like to know the information about the status of file being monitored.
<s:key name="/root/test.log">
<s:dict>
<s:key name="file position">2252994</s:key>
<s:key name="file size">2252994</s:key>
<s:key name="percent">100.00</s:key>
<s:key name="type">**open file**</s:key>
</s:dict>
</s:key>
and,
<s:key name="/opt/splunkforwarder/var/log/splunk/license_audit.log">
<s:dict>
<s:key name="file position">0</s:key>
<s:key name="file size">0</s:key>
<s:key name="parent">$SPLUNK_HOME/var/log/splunk/splunkd.log</s:key>
<s:key name="percent">100</s:key>
<s:key name="type">**finished reading**</s:key>
</s:dict>
</s:key>
Any information would be appreciated.
Splunk assumes that a new event can always be added to any file, so it will keep monitoring every files.
about the REST endpoint, when the percent is 100% :
Splunk assumes that a new event can always be added to any file, so it will keep monitoring every files.
about the REST endpoint, when the percent is 100% :
Thank you for your answer, I am looking for this type of information in a documentation, but I still can not find it. I would really appreciate if you point me to the location in a doc or any other location.