File Monitoring Issues - Splunk Enterprise Troubleshooting Use Case - 24

14.06.24 07:23 PM - By Murugan

File Monitoring Issues:

Issue:

Log file monitoring is enabled in Windows, but data is not coming.

Root cause:

Splunk keeps ignoring it, stating that it's a binary file.

02-26-2016 09:26:54.574 -0500 WARN FileClassifierManager - The file C:\Temp\w32tmdebug.log' is invalid. Reason: binary

02-26-2016 09:26:54.574 -0500 INFO TailReader - Ignoring file 'C:\Temp\w32tmdebug.log' due to: binary

Solution:

Disable the binary check & set the charset to “AUTO“

Filename: $SPLUNK_HOME\etc\apps\yourapp\local\props.conf

[yoursourcetype]

NO_BINARY_CHECK=true

CHARSET=AUTO