can't find data

ryanaa — Fri, 15 Mar 2024 07:03:10 GMT

我現在遇到一個問題，我在SH放置好一個apps並連到uf上，在uf上也有監控到資料路徑，

但我在search時就沒有辦法找

以下是我的 inputs.conf：

[monitor:///tutorialdata/www*/access.log] index = web host_segment=2 sourcetype = web:access [monitor:///tutorialdata/www*/secure.log] index = web host_segment=2 sourcetype = web:secure

以及props.conf

EVENT_BREAKER_ENABLE = true EVENT_BREAKER = ([\r\n]+) [web:secure] EVENT_BREAKER_ENABLE = true EVENT_BREAKER = ([\r\n]+)

Re: can't find data

richgalloway — Sun, 17 Mar 2024 14:37:37 GMT

Please make sure the inputs.conf file is installed on the UF.

Can you search for the UF's internal logs on the SH? If not, then the UF is not properly connected to the SH/indexer. Do you have a separate indexer?

Confirm the UF has read access to the files it is trying to monitor.

Please share the query you are using to search for the data on the SH.

topic can't find data in Getting Data In

can't find data

Re: can't find data