File monitor input is not ingesting data

Applicability

Description

Splunk appears to be forwarding data, but a file monitor input for a specific data source is not working. Troubleshooting indicates no issues with forwarding and receiving. The file is present, but no data is seen from Splunk.

Investigation

Check if Splunk can access the file. This Splunk command will help determine what Splunk is seeing (if anything). The use of grep may be necessary to find the input in question as the output may be cumbersome:

splunk list inputstatus

The output will list each input and the position in the file according to the fishbucket. If grep is used to look for the file, try using the -A switch to allow multiple lines:

splunk list inputstatus | grep -A 5 <monitorFileName>

This is an example of a working file monitor input:

splunk list inputstatus | grep -A 5 wlm_monitor
	/opt/splunk/var/log/splunk/wlm_monitor.log
		file position = 0
		file size = 0
		parent = $SPLUNK_HOME/var/log/splunk
		percent = 100
		type = finished reading

Seeing the following results for the monitor input in question indicates Splunk is unable to read the file:

<pathToFileNotBeingIngested>
      type = missing

Resolution

Resolve file access issues at the operating system level. The user Splunk is running as must have read access to the file it is trying to monitor.