topic Re: Not able to read in Getting Data In

Not able to read

sibanandapani1 — Thu, 09 Oct 2014 20:13:53 GMT

Could you please help me in getting file?

Re: Not able to read

jrodman — Fri, 10 Oct 2014 09:15:11 GMT

Few problems here:

By default, there is no index called audit_index.

But more importantly, the way splunk handles the audit file is.. black magic. The events are put directly into the indexing queue, and also written out the file. We never read the data from the file into the index. In order to make this work, we have a rule that arranges for the audit.log data to be null routed when tailed.

Options:

monitor the file under another name, such as via a symbolic link.
Don't do this at all, and simply use forwarding/distributed search to see the data.

Re: Not able to read

sibanandapani1 — Fri, 10 Oct 2014 18:33:22 GMT

Thank you.

Re: Not able to read

sibanandapani1 — Fri, 10 Oct 2014 20:46:18 GMT

Symbolic link is able to read the file, which is pointing to same file. But why not the same file directly, any reason for so?

Re: Not able to read

jrodman — Fri, 10 Oct 2014 21:25:33 GMT

The reason is to avoid having that data in the index twice. The mechanism is as already stated. Please do not adjust the mechanism, it will make you sad.

Re: Not able to read

sibanandapani1 — Fri, 10 Oct 2014 21:34:04 GMT

Got you. Sorry to bother much but I am not understanding one point here.

Just curious to know file which we are not able to monitor from an another instance of splunk, can be monitored through symbolic link which is pointing to the same file. It will be really helpful for me, if you can let me know a bit more deeply.

Thanks a lot in advance.