topic Data is not ingesting into splunk from UF in Getting Data In

Data is not ingesting into splunk from UF

sekhar463 — Wed, 20 Dec 2023 09:13:19 GMT

i have added this file in monitoring to ingest data but data is not getting ingesting
log file path is /tmp/mountcheck.txt

[monitor:///tmp/mount.txt]
disabled = 0
index = Test_index
sourcetype =Test_sourcetype
initCrcLen = 1024
crcSalt = "unique_salt_value"

gcusello — Wed, 20 Dec 2023 09:32:50 GMT

at first probaby you don't need crcSalt option, so, try without.

Anyway, the syntax is fixed, <SOUCE> isn't a variable, you have to use it as is:

crcSalt = <SOURCE>

Ciao.

Giuseppe

isoutamo — Wed, 20 Dec 2023 20:01:23 GMT

probably you have copy paste error with file name as those don’t match?

You could check if uf has read that file by

splunk list inputstatus

r. Ismo