topic Re: Light forwarder can't find index? in Getting Data In

Light forwarder can't find index?

dlindsay — Tue, 17 May 2011 16:19:22 GMT

I have a server side index named dev4.
However, when configuring my forwarder using this command:

splunk add monitor /home/ilpcore/ILPcore/logs/tcat-agent-sys.2011-05-16.log -index dev4 -sourcetype ILPcore -auth admin:changeme

I get the following error:

In handler 'monitor': Parameter index: Index 'dev4' does not exist. Please provide a valid index.

What am I doing wrong?

Re: Light forwarder can't find index?

jbsplunk — Tue, 17 May 2011 16:27:05 GMT

The CLI on the light forwarder doesn't understand that you are providing a remote index, as code for the CLI is the same from a UF/LWF/Indexer. When you specify an index, it will presume an index specified in the CLI exists locally. You'll need to specify the index in inputs.conf under the monitor stanza you've created via the CLI for remote indexes on the LF/UF.

There is a feature request in to ask for an argument to specify a remote index and/or provide a warning page if the index does not exist to warn you that the index must exist remotely.

This issue was also addressed in the following splunk answers post:

http://splunk-base.splunk.com/answers/12960/how-to-use-custom-index-for-universal-forwarder

Re: Light forwarder can't find index?

dlindsay — Tue, 17 May 2011 16:37:08 GMT

So are you saying that I need to add the monitor first without specifying the index, and then manually edit the inputs.conf file?

Also, which file is it?

find . -type f -name inputs.conf
./etc/system/default/inputs.conf
./etc/apps/SplunkUniversalForwarder/default/inputs.conf
./etc/apps/SplunkLightForwarder/default/inputs.conf
./etc/apps/SplunkDeploymentMonitor/local/inputs.conf
./etc/apps/sample_app/default/inputs.conf
./etc/apps/search/local/inputs.conf
./etc/modules/distributedDeployment/classes/deployable/inputs.conf

Re: Light forwarder can't find index?

jbsplunk — Tue, 17 May 2011 16:39:50 GMT

That is correct. If you take a look at the other post I referenced, there are steps provided for finding the specific input:

The file is probably in $SPLUNK_HOME/etc/apps/search/local/, but you might have to look for it:

./splunk cmd btool --debug inputs list monitor:///path/specified

find $SPLUNK_HOME/etc -name inputs.conf | xargs grep -l '^[monitor:///path/specified'