topic Re: Some files are not being indexed in Getting Data In

Some files are not being indexed

cchange — Thu, 26 Oct 2017 05:02:39 GMT

Hi,

I configured inputs.conf to monitor a directory. All the files in the directory were not ingested to Splunk. Some XML files are being missed. I don't see any errors in the _internal logs. Can you please let me know if I'm missing any property in my configuration file?

my sample inputs.conf

index=test
sourcetype=test

Re: Some files are not being indexed

gcusello — Thu, 26 Oct 2017 06:57:02 GMT

Hi cchange,
could you share your inputs.conf and the pathnames of your target files?
Bye.
Giuseppe

Re: Some files are not being indexed

cchange — Thu, 26 Oct 2017 18:26:24 GMT

Hello.

It look like this.

monitor:\\directory
index=test
sourcetype=test1
disabled=0

Re: Some files are not being indexed

gcusello — Fri, 27 Oct 2017 10:51:07 GMT

Hi cchange,
there are some errors, you should have esomething like this:

[monitor://C:\directory\myfile.txt]
index=test
sourcetype=test1
disabled=0

remember that the first two slashes are fixed, in unix you have another one slash, instead in Windows you have the full path (with drive) of the files to monitor; you can also use *.
For more information see http://docs.splunk.com/Documentation/Splunk/latest/Data/Getstartedwithgettingdatain .
Bye.
Giuseppe

Re: Some files are not being indexed

kannu — Fri, 27 Oct 2017 12:02:15 GMT

check your splunkd log in splunkhome/var/log/splunk/
for example
if you are looking file abc.txt then
cat splunkd.log | grep -i "abc.txt"

you will get the error message if not you will see the following entry [addingwatcher] that means file has been watched you will soon see the file contents on your search head

Re: Some files are not being indexed

cchange — Sun, 12 Nov 2017 22:44:39 GMT

I added crcSalt = and missing files were ingested successfully.