topic Re: Data not incoming in Getting Data In

Data not incoming

BoldKnowsNothin — Sun, 24 Sep 2023 09:09:51 GMT

My dear comrades,

I'm facing something unreal. We just deployed application on the host that looks like [monitor://C:\Data\log\*].

Unfortunately we cannot see any entries on splunk.

But when I copied some files to another location on host and also we changed application to something like [monitor://C:\Program Files\Data\log\*]. It sends data.

The folders permission etc are all same. Our application is hard coded so we cannot change the path just like this test.

Any help will be much appreciated

Re: Data not incoming

SanjayReddy — Sun, 24 Sep 2023 11:37:09 GMT

Hi @BoldKnowsNothin

Did you see any warning/error messages in splunkd.log for file you intially monitored.
log messages in splunkd.log will help to troubleshoot furthur

Re: Data not incoming

VatsalJagani — Mon, 25 Sep 2023 03:18:53 GMT

@BoldKnowsNothin - Please check to see if you have any errors/warnings from that host as suggested by @SanjayReddy .

Also, check if Splunk service is run by a local user or System user on Windows and check if that user running Splunk service has permission to read logs from that folder.

I hope this helps!!!

Re: Data not incoming

Zane — Tue, 26 Sep 2023 02:16:57 GMT

I guess you don't have permission of root directory of C drive, because it's worked when you place file into "C:\Program Files", just check if you can create the new file (instead of folder) in roo directory of C drive. I guess you should only have permission to create folders now.