I have an input, which is a CSV file. I want to use this as a batch input. The file is generated every day, with the same name.
Most of the time, the beginning of the file is also the same. That's why I think the only method I can achieve to have this ingested every day is to use the `CHECK_METHOD = modtime` in props.conf
After setting it, I've checked my splunkd.log, I can see that because of the new modtime, Splunk started to read the file, but now I'm getting this messages:
TailReader - Will retry path="" after deferring for 10000ms, initCRC changed after being queued (before=0xd71b3bcce79fb3d8, after=0xb5a12ee23beafb6a). File growth rate must be higher than indexing or forwarding rate.
I've tried restarting my forwarder, deleting the fishbucket, but I'm still getting this error. (The file wasn't modified during this time)
↧