topic Re: how to configure inputs.conf? in Getting Data In

how to configure inputs.conf?

khandelwaly — Wed, 30 Sep 2020 05:00:53 GMT

i have logs like this :

-rw-r----- 1 jira jira 4921534 Apr 13 22:42 catalina.2020-04-13.log
-rw-r----- 1 jira jira 463769261 Apr 14 00:00 access_log.2020-04-13
-rw-r----- 1 jira jira 2840014 Apr 14 13:08 catalina.2020-04-14.log
-rw-r----- 1 jira jira 222675515 Apr 14 13:08 access_log.2020-04-14

How to configure inputs.conf for the access_log
I tried below but it didnot work

[monitor:////apps/logs/access_log]
index = prdidx
blacklist = .(gz)$
sourcetype = ACCESS
_TCP_ROUTING = WEB

Re: how to configure inputs.conf?

richgalloway — Tue, 14 Apr 2020 20:47:48 GMT

What is the full path of the log files shown?

Re: how to configure inputs.conf?

to4kawa — Tue, 14 Apr 2020 20:50:33 GMT

# The following configuration reads all the files in the directory /var/log.

[monitor:///var/log]

there is too many /

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

Re: how to configure inputs.conf?

khandelwaly — Tue, 14 Apr 2020 20:50:55 GMT

files are under /apps/logs/

Re: how to configure inputs.conf?

khandelwaly — Tue, 14 Apr 2020 20:52:21 GMT

I removed the / but still the same thing. I don't want to read all the files in that directory. I want to only read access_log

Re: how to configure inputs.conf?

khandelwaly — Tue, 14 Apr 2020 20:54:14 GMT

Tried below but still failing
[monitor:///apps/logs/] index = prdidx blacklist = \.(gz)$ whitelist = access_log\.*$ sourcetype =ACCESS _TCP_ROUTING = WEB

Re: how to configure inputs.conf?

to4kawa — Tue, 14 Apr 2020 21:25:32 GMT

blacklist = .(gz)$
→
whitelist = \.log$
How about this?

Re: how to configure inputs.conf?

to4kawa — Tue, 14 Apr 2020 21:29:39 GMT

and check sourcetype

Re: how to configure inputs.conf?

PavelP — Tue, 14 Apr 2020 21:37:33 GMT

if splunk runs as not root user then you have to add splunk to jira group, here is an example if splunk(forwarder) runs as a splunk user:

usermod -a -G jira splunk

Re: how to configure inputs.conf?

khandelwaly — Tue, 14 Apr 2020 21:44:58 GMT

Splunk restart is fine. Only files under the mentioned directory is not shown on Splunk. Need help to configure the inputs.conf

Re: how to configure inputs.conf?

khandelwaly — Tue, 14 Apr 2020 21:46:01 GMT

Files are not ending with .log. Tried _log but did not work

Re: how to configure inputs.conf?

PavelP — Tue, 14 Apr 2020 21:58:06 GMT

Does splunk run as a root user?

Re: how to configure inputs.conf?

to4kawa — Tue, 14 Apr 2020 22:01:48 GMT

what's your sourcetype now?

Re: how to configure inputs.conf?

richgalloway — Tue, 14 Apr 2020 23:22:23 GMT

Try

[monitor:///apps/logs/access_log/access_log.*]

Re: how to configure inputs.conf?

khandelwaly — Wed, 15 Apr 2020 05:09:59 GMT

yes it run as root.

Re: how to configure inputs.conf?

khandelwaly — Wed, 30 Sep 2020 05:00:56 GMT

logs file name is access_log.2020-04-14. No folder with name access_log.
Tried without access_log folder as well but it didnot work

Re: how to configure inputs.conf?

to4kawa — Wed, 15 Apr 2020 09:44:44 GMT

https://docs.splunk.com/Documentation/Splunk/8.0.3/Troubleshooting/Cantfinddata

Re: how to configure inputs.conf?

richgalloway — Wed, 15 Apr 2020 12:35:19 GMT

Did you restart the forwarder after changing inputs.conf?
Does Splunk have read access to the logs?
Do the files appear in the output of the CLI command splunk list monitor?