topic Re: inputs.conf - Troubleshooting through the CLI Possible? in Getting Data In

inputs.conf - Troubleshooting through the CLI Possible?

A4orce84 — Wed, 28 Dec 2011 22:39:33 GMT

Hello Everyone,

I am trying to do some troubleshooting on our inputs.conf, specifically the forwarder is pulling in logs to the indexer correctly. However, the issue I am experiencing is that I have modified the inputs.conf on the forwarder to pull in xml files in a new location, but they are not showing up.

Is there a way I can debug the inputs.conf and see what files it is pulling in / what is being blacklisted and why through the command line interface?

Thanks in advance !

--Asif Ahmad
Asif.Ahmad@ni.com

Re: inputs.conf - Troubleshooting through the CLI Possible?

dwaddle — Wed, 28 Dec 2011 22:58:12 GMT

Amrit's input processor script may help, http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/

Re: inputs.conf - Troubleshooting through the CLI Possible?

Genti — Thu, 29 Dec 2011 00:21:30 GMT

This (below) should tell you all you need to know about your inputs.

./splunk cmd btool inputs list --debug

Also, you might want to set tailingprocessor in debug mode (log.cfg) and check what the logs (splunkd.log) say about the particular input you are looking for...

Re: inputs.conf - Troubleshooting through the CLI Possible?

A4orce84 — Thu, 29 Dec 2011 21:08:43 GMT

Thanks for the replies guys!

Genti -- I am not really seeing anything related to my specific inputs.conf change. Is there something (stanza) I need to look at specifically?

Thanks.

--Asif

Re: inputs.conf - Troubleshooting through the CLI Possible?

Genti — Thu, 29 Dec 2011 21:14:49 GMT

you mentioned: "I have modified the inputs.conf on the forwarder to pull in xml files in a new location"
This means that there should be a stanza in your inputs.conf about these xml files. As such, you SHOULD definitely see these when you do a btool on inputs.
Did you do this on the forwarder side?

Re: inputs.conf - Troubleshooting through the CLI Possible?

mikelanghorst — Mon, 02 Jan 2012 22:33:07 GMT

The great part about using this, is that it will actually tell you the files if found under the monitor path, and the results of why it isn't indexing them if that's the case.