Inputs.conf not being read

leon24 — Mon, 28 Sep 2020 19:54:07 GMT

OK this sounds pretty embarrassing. I have set up quite a fair bit of Splunkforwarders previously but now I some of my newly configured forwarders are unable to forward the logs to the indexers (or the indexers are unable to index the logs forwarded).

This is what is in my inputs.conf in $SPLUNK_HOME$/etc/apps/iis/local/ in the server where my forwarder is installed.

[install] state = enabled

[monitor://D:\Logs\]

disabled = 0
followTail = 0
index = project_index
blacklist = .(1|2|3|4|5|6|7|8|9|0)$
sourcetype = project_logs

The issue here is that this particular forwarder is able to send perfmon logs to the indexer, but is unable to read this particular inputs.conf file.

My search at the search head is simply <code>index = project_index | stats count by sourcetype</code>, but I'm not seeing the project_logs sourcetype appearing at all, only apart from the perfmon sourcetype.

Am I missing anything here?

Regards

Re: Inputs.conf not being read

woodcock — Tue, 19 May 2015 15:07:00 GMT

Could be permissions if you are not running splunk as root/admin user; have you checked ownership and permissions? Or perhaps you have the path wrong; try this (missing backslash):

[monitor://D:\Logs]

Re: Inputs.conf not being read

woodcock — Thu, 27 Aug 2015 14:04:23 GMT

Did you get this working?

topic Re: Inputs.conf not being read in Getting Data In

Inputs.conf not being read

Re: Inputs.conf not being read

Re: Inputs.conf not being read