topic Why am I unable to read logfiles? in Getting Data In

Why am I unable to read logfiles?

twh1 — Wed, 05 Sep 2018 10:36:28 GMT

I am trying to read log files from a server. I have made all the configuration in Splunk but data is not coming in Splunk search. When I checked Splunk's internal log, I got a permission denied error for that server. I logged to the specific server and verified that all users have read permission to path I am trying to Monitor.

Can anyone suggest what could be the real cause for this issue.

Below is the inputs.conf configuration

[monitor:///usr2/oracle/saltlog/*logs.log]
sourcetype = oracle_os:healthcheck
index = os_na
interval = 600
crcSalt = <SOURCE>

Below is the props.conf configuration

[sourcetype:oracle_os:healthcheck]
SHOULD_LINEMERGE= true
NO_BINARY_CHECK = true
BREAK_ONLY_AFTER = TIMESTAMP=
TRUNCATE =9999
TZ = US/Eastern

Re: Why am I unable to read logfiles?

harsmarvania57 — Wed, 05 Sep 2018 10:45:34 GMT

Hi @twh1,

Login to the server on which logfile exists and try to read that log files using cat command with same user as splunk service is running and check whether there is any file permission issue is there or not.

Additionally props.conf which you have provided should be on Indexer OR Heavy Forwarder whichever comes first from Universal Forwarder.

Re: Why am I unable to read logfiles?

twh1 — Thu, 06 Sep 2018 17:28:47 GMT

Thanks @harsmarvania57 . I moved props.conf on indexer but after that also I was getting same error. There was an issue with folder permission. Splunk user had read permission for file but not for the folder. So I was getting permission denied error.