In the limits.conf below the stanza [inputproc] please set the file_tracking_db_threshold_mb attribute into a lower value.
$SPLUNK_HOME/etc/system/local/
[inputproc] file_tracking_db_threshold_mb attribute_mb =
Here it is documentation about the file_tracking_db_threshold_mb:
And here is a documentation file about the workaround where you can find here: Known issues=Forwarder/7.2.4.
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
28-Sep-2026
|
Initial Release |