topic Re: "Continuously index data from a file or directory this Splunk instance can access" in Getting Data In

"Continuously index data from a file or directory this Splunk instance can access"

Rukmani_Splunk — Fri, 21 Feb 2014 12:59:39 GMT

Data is being indexed if i use the option "Index a file once from this Splunk server"
But not indexed if i use "Continuously index data from a file or directory this Splunk instance can access" option . Please help.

Re: "Continuously index data from a file or directory this Splunk instance can access"

krish3 — Fri, 21 Feb 2014 13:30:09 GMT

Try adding it in inputs.conf file.

[monitor:///location/to/log/file/folder]
index = test1
sourcetype = log4j
disabled = false

Re: "Continuously index data from a file or directory this Splunk instance can access"

krish3 — Fri, 21 Feb 2014 13:31:06 GMT

Back slashes if your using on windows platform..

Re: "Continuously index data from a file or directory this Splunk instance can access"

somesoni2 — Fri, 21 Feb 2014 14:12:39 GMT

See status of file input here.

https://YOURHOST:8089/admin/services/inputstatus/TailingProcessor:FileStatus

Re: "Continuously index data from a file or directory this Splunk instance can access"

Rukmani_Splunk — Mon, 10 Mar 2014 08:08:54 GMT

Thank you so much it helped me a lot. It was asking fro crcSalt

Re: "Continuously index data from a file or directory this Splunk instance can access"

Rukmani_Splunk — Mon, 10 Mar 2014 08:09:26 GMT

Thank you so much . it was crcSalt issue