topic Re: Why is Splunk not reading existing files from same server? in Getting Data In

Why is Splunk not reading existing files from same server?

ram254481493 — Wed, 29 May 2019 18:47:12 GMT

Currently, I have setup inputs.conf, Splunk is reading all the directories in the inputs file- but not reading one file.
I tried using crcSalt but nothing works.
It's reading first 3 monitor paths but not reading the last one.
All three are from the same server and the log exists.

[monitor://D:\Talx.xxx\EDRService.xxxx\AppLogs*]
disabled = false
recursive = false
index = xxxxxx
sourcetype = xxxxxx

[monitor://D:\AuditAndxxxxxx\TWNEmployerServiceP0xxxxxx.trace.*]
disabled = false
recursive = false
index = xxxxx
sourcetype = xxxxxx

[monitor://D:\AuditAndxxxxx\TWNEmployerxxxxx.*]
disabled = false
recursive = false
index = xxxxx
sourcetype = xxxxxx

[monitor://D:\Talx.xxxxxxx\TWNEmployer.xxxxxx_Logs\AppLogs.*]
disabled = false
recursive = false
index = pxxxxxx
crcSalt = 
sourcetype = xxxxxxxxxxx

Re: Why is Splunk not reading existing files from same server?

richgalloway — Wed, 29 May 2019 19:27:59 GMT

Verify Splunk has read access to the directories and files it is to monitor.
Check splunkd.log for related error messages.
Run splunk btool --debug inputs list to verify the configuration.
Run splunk list monitor to verify what Splunk is monitoring.

Re: Why is Splunk not reading existing files from same server?

ram254481493 — Wed, 29 May 2019 20:08:15 GMT

sure thanks for your help it was a issue with my monitoring stanza. And its resolved.

Re: Why is Splunk not reading existing files from same server?

richgalloway — Thu, 30 May 2019 12:56:25 GMT

To help future readers, please add and accept an answer explaining how you resolved the problem.

Re: Why is Splunk not reading existing files from same server?

ram254481493 — Thu, 30 May 2019 14:27:28 GMT

hi i am not able to accept the answer , i cannot see the accept answer button. In my monitoring path i had an extra space so its not reading the logs , i removed the extra space and i restart the forwarder , it starts flowing the logs.

Re: Why is Splunk not reading existing files from same server?

ram254481493 — Thu, 30 May 2019 21:36:27 GMT

Thanks now i am able to do it