Splunk Apps » File Meta-data Monitoring

Have started using the file-info status add on. An issue that I have found when executing this input from a Windows 2008 R2 server running Splunk 6.3 Indexer.

It seems that whenever the script encounters the scenario where a file disappears during its fun, it logs an error and then does not run again until Splunk is restarted.

An example of the error:

2015-06-25 11:32:13,809 INFO Successfully retrieved file data, count=333, path=\\bpovsql1\bpo_Prod_data\QBE\FaxMail\Incoming
2015-06-25 11:32:39,424 INFO Successfully retrieved file data, count=11, path=D:\Splunk\lib\node_modules\request
2015-06-25 11:33:14,805 ERROR Execution failed
Traceback (most recent call last):
File "D:\Splunk\etc\apps\file_meta_data\bin\file_info_app\modular_input.py", line 1277, in execute
self.do_run(in_stream, log_exception_and_continue=True)
File "D:\Splunk\etc\apps\file_meta_data\bin\file_info_app\modular_input.py", line 1177, in do_run
input_config)
File "D:\Splunk\etc\apps\file_meta_data\bin\file_meta_data.py", line 117, in run
results = self.get_files_data(file_path, logger=self.logger)
File "D:\Splunk\etc\apps\file_meta_data\bin\file_meta_data.py", line 58, in get_files_data
results.append(cls.get_file_data(os.path.join(root, name), logger))
File "D:\Splunk\etc\apps\file_meta_data\bin\file_meta_data.py", line 77, in get_file_data
stat_info = os.stat(file_path)
WindowsError: [Error 2] The system cannot find the file specified: u'\\\\bpovsql1\\bpo_Prod_data\\QBE\\FaxMail\\Incoming\\UFCWorking\\Mail01_20150625_112941_7136_LLFNN732_02.tif'