Blog tagged as File Monitoring Issue

Issue:

Monitored file suddenly stops being monitored/indexing.

Root cause:

File growth rate is higher than indexing or forwarding rate. (maxKBps value is too low)

[thruput]
maxKBps = 384

Solution:

Change the maxKBps value to a higher value(increase the maxKBps value upto 500) & R...

14.06.24 07:23 PM - Comment(s)

Issue:

Log file monitored is enabled, but data is not getting indexed

Root cause:

Another file also has the first 256 characters same.

Note: If multiple files, have the first 256 same, then Splunk will consider only one file.

Solution:

Add “crcSalt=<text>“ under the respective stanz...

14.06.24 07:23 PM - Comment(s)