topic Re: Cant find data added through inputs.conf in Getting Data In

Cant find data added through inputs.conf

vaishnavi07 — Fri, 14 Nov 2014 06:17:26 GMT

I tried adding the data through inputs.conf. I am trying to add sample log file from my system to the splunk server. I added the below code to inputs.conf and restarted the server but i dont find any data in my index.

[monitor://C:\Windows\WindowsUpdate.log]
disabled=0
index=windowsupdate_test
sourcetype=windowsupdate

Does anyone know what may be the issue here? Thanks in advance.

Re: Cant find data added through inputs.conf

MuS — Fri, 14 Nov 2014 06:58:25 GMT

Hi vaishnavi07,

there is a long list of possible issues here:

does the user running splunk have read rights on this file?
can you reach the index server from the UF (if you're using an UF, which is an universal forwarder)?
did you check on the source, where you changed the inputs.conf, in $SPLUNK_HOME\var\log\splunk\splunkd.log for any errors?
did you do an all time search on the index=windowsupdate_test ?
do you have the permission do search this index?
does this index exist?
typos anywhere?
.......

hope this helps to get you started

cheers, MuS

Re: Cant find data added through inputs.conf

splunker12er — Fri, 14 Nov 2014 07:01:21 GMT

Did you search for all time?
Did you see any errors at splunkd.log ?
Are you using universal forwarder ?
- Check for the outputs.conf file for the correct IP of the indexer your are forwarding .

Re: Cant find data added through inputs.conf

vaishnavi07 — Fri, 14 Nov 2014 07:06:38 GMT

Yes i have read rights on the file. I checked in splunkd.log and there are no entries in it. And also i did an All time search on the index. I have admin rights on the server and i have write permissions on this index.

Re: Cant find data added through inputs.conf

vaishnavi07 — Fri, 14 Nov 2014 07:08:02 GMT

The index name is also not there in the splunkd.log. Does this mean there are no errors or it dint add the data at all?

Re: Cant find data added through inputs.conf

vaishnavi07 — Fri, 14 Nov 2014 07:10:33 GMT

When i try adding the same file through UI page it is working. But when i add it through inputs.conf i am not getting the data.

Re: Cant find data added through inputs.conf

MuS — Fri, 14 Nov 2014 07:16:44 GMT

did you created an index called windows update_test?

Re: Cant find data added through inputs.conf

MuS — Fri, 14 Nov 2014 07:18:06 GMT

you are aware the fact, that once indexed data will not be re-indexed by Splunk simply because you add once again using a different method? You have to clean the so called fishbucket first, this is where Splunk saves what already was indexed.

Re: Cant find data added through inputs.conf

vaishnavi07 — Fri, 14 Nov 2014 07:18:19 GMT

Yes i searched for all time. I only need to add data into my server. For now i am not forwarding the data to any othere server.

Re: Cant find data added through inputs.conf

vaishnavi07 — Fri, 14 Nov 2014 07:23:55 GMT

Yes that is fine. Even when i add new data it is not getting added. Anything through inputs.conf is not adding.

Re: Cant find data added through inputs.conf

MuS — Fri, 14 Nov 2014 07:25:02 GMT

where is this inputs.conf located? check for typos in that file

Re: Cant find data added through inputs.conf

vaishnavi07 — Fri, 14 Nov 2014 07:30:20 GMT

it is located in $SPLUNK_HOME$/etc/system/local. I checked for the typos but everything is fine.Whatever i have posted in the question is what i have given there.

Re: Cant find data added through inputs.conf

MuS — Fri, 14 Nov 2014 07:36:56 GMT

run $SPLUNK_HOME\bin\splunk cmd btool --debug inputs list monitor and check if your monitor stanza is listed

Re: Cant find data added through inputs.conf

vaishnavi07 — Mon, 28 Sep 2020 18:09:43 GMT

When i run the command it shows that $SPLUNK_HOME should be set. But when i checked in splunk-launch.conf the SPLUNK_HOME is set correctly.

Re: Cant find data added through inputs.conf

vaishnavi07 — Fri, 14 Nov 2014 10:16:05 GMT

When i check splunkd.log it is showing error as path is not aboslute.

Re: Cant find data added through inputs.conf

jrodman — Fri, 14 Nov 2014 15:55:20 GMT

For a monitor line such as
[monitor://C:\Windows\WindowsUpdate.log] you will get an error that it is not absolute if you are running on UNIX. Are you running on UNIX?

Re: Cant find data added through inputs.conf

vaishnavi07 — Fri, 14 Nov 2014 16:48:16 GMT

Yes am running on linux. Is it not the format?

Re: Cant find data added through inputs.conf

vaishnavi07 — Sun, 16 Nov 2014 03:41:20 GMT

Hi Jrodman. Can you tell me the format as to how i should provide the path?

Re: Cant find data added through inputs.conf

thambisetty — Sun, 16 Nov 2014 12:30:51 GMT

Hi Vaishavai07,

May I know Operating system of the forwarder splunk instance and Receiver splunk instance ( Indexer)?,hi vaishnavi,
may I know from which OS you want to get the data in? OR OS of the forwarder?
on which OS u have installed splunk server? OR OS of the Indexer(Receiver)?

OS - operating SYstem

Re: Cant find data added through inputs.conf

vaishnavi07 — Sun, 16 Nov 2014 16:39:26 GMT

Splunk is installed on linux machine. I am only trying to add the file by adding stanza in inputs.Conf but it is showing error as pathbis not absolute.