topic Re: Why is splunk not indexing new files in monitered folder? in Getting Data In

Why is splunk not indexing new files in monitered folder?

jameshgibson — Fri, 11 Jan 2013 09:46:37 GMT

This is on a Windows box to a windows network location. I have set up an input on a folder located on a network drive with the following in my inputs.conf

[monitor://\\myserver\tempfolder$\Logs\logfileprefix*] disabled = false followTail = 0 host = myserver sourcetype = my-source-type index = main

However no logs are getting indexed. I have already checked that the splunk account can access this folder.

EDIT 2: In the splunk management page you can see that it has found hundreds of files to index. But they cannot be found when searching.

EDIT: I can index the files using splunks oneshot command

splunk add oneshot "\\myserver\tempfolder$\Logs\logfileprefix.log" -sourcetype "my-source-type" -index "main" -host "%host%"

Re: Why is splunk not indexing new files in monitered folder?

MuS — Fri, 11 Jan 2013 10:01:39 GMT

Hi jameshgibson

does the account running splunkd have network access? By default this is not allowed for system services, so you have to enable this first.

cheers,
MuS

Re: Why is splunk not indexing new files in monitered folder?

jameshgibson — Fri, 11 Jan 2013 11:19:23 GMT

Good idea but I assume that as splunk oneshot works then it must be able to access it.

Re: Why is splunk not indexing new files in monitered folder?

MuS — Fri, 11 Jan 2013 12:39:46 GMT

do you get any errors in splunkd.log?

Re: Why is splunk not indexing new files in monitered folder?

jameshgibson — Fri, 11 Jan 2013 12:53:10 GMT

getting a lot of warnings for: 01-11-2013 10:00:43.134 +0000 WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user

Re: Why is splunk not indexing new files in monitered folder?

MuS — Fri, 11 Jan 2013 12:59:05 GMT

this is related to authentication between search heads and search peers and not file monitoring -> http://splunk-base.splunk.com/answers/27523/splunkdlog-denied-session-token-for-user-splunk-system-user
but check this out http://splunk-base.splunk.com/answers/58727/unc-path-with-sign looks like the $ is your problem

Re: Why is splunk not indexing new files in monitered folder?

jameshgibson — Fri, 11 Jan 2013 14:38:37 GMT

I saw that but from the answer I can't see anything he changed to fix it. Also the answer directly below seems to suggest that it is not the case.

Re: Why is splunk not indexing new files in monitered folder?

MuS — Fri, 11 Jan 2013 14:44:18 GMT

ok then quick and dirty test, use the unc path without $ and see if it works. If yes; you can file a case and ask support how this must be done with a hidden unc share

Re: Why is splunk not indexing new files in monitered folder?

MuS — Fri, 11 Jan 2013 14:49:15 GMT

found this one, where the solution was to use a different user to run splunk -> http://splunk-base.splunk.com/answers/4614/how-do-i-monitor-a-unc-path

Re: Why is splunk not indexing new files in monitered folder?

yannK — Fri, 11 Jan 2013 16:18:16 GMT

Check if your file have a static header, and are skipped because they are considered as duplicates. Test by adding a comment on the first line, and look at the crc options in inputs.conf

Re: Why is splunk not indexing new files in monitered folder?

jameshgibson — Fri, 11 Jan 2013 16:38:58 GMT

the files not indexed are completely new with a different name and timestamp etc. so I dont think this is the problem.

Re: Why is splunk not indexing new files in monitered folder?

jameshgibson — Fri, 11 Jan 2013 16:52:53 GMT

gave changing the user account a bash, but no change unfortunatly

Re: Why is splunk not indexing new files in monitered folder?

yannK — Fri, 11 Jan 2013 17:34:45 GMT

ok, so this is an input misconfigured, or a permission issue.
Or a forwarding issue. (to check if the forwarding if working for other files , search on the indexer for index=_internal host=myfowarder)

Re: Why is splunk not indexing new files in monitered folder?

jameshgibson — Mon, 28 Jan 2013 15:49:36 GMT

turns out this was nothing to do with any of the characters or permissions. For some reason the ending of logfileprefix* was causing the problem (despite working on non network folders). I swapped this to use a whitelist instead...which didn't work. Finally I added a blacklist which did.

The final working config looks similar to:

[monitor://\\myserver\tempfolder$\Logs] disabled = false followTail = 0 sourcetype = mysourcetype whitelist = blacklist = (something|BLAH\-[0-9]+) index = tmp

Re: Why is splunk not indexing new files in monitered folder?

season88481 — Wed, 08 Jun 2016 05:49:27 GMT

I have the same problem. So I add a fake header on my new files. And Splunk start ingesting the file!! Thanks for your tips!!!