https://community.splunk.com/t5/Monitoring-Splunk/internal-Index-not-indexing-application-log/m-p/439959#M3702 <P>Hi @robettinger </P> <P>This should work fine. I have my own log for my personal custom app and it writes to <CODE>/opt/splunk/var/log/splunk/my_app.log</CODE> and it is being read into _internal just fine - no additional inputs.conf stanzas required.</P> Thu, 31 Jan 2019 09:21:13 GMT chrisyounger 2019-01-31T09:21:13Z https://community.splunk.com/t5/Monitoring-Splunk/internal-Index-not-indexing-application-log/m-p/439958#M3701 <P>Hi,</P> <P>we created an app which writes its log into $SPLUNK_HOME/var/log/splunk</P> <P>Event though the folder is being monitored with no blacklisted files, the application log is not being indexed. There is no mention to send_to_null_queue for this particular file so I am a bit confused.</P> <P>You guys have any idea?</P> <P>Thanks,<BR /> Robert</P> Tue, 29 Sep 2020 23:02:26 GMT https://community.splunk.com/t5/Monitoring-Splunk/internal-Index-not-indexing-application-log/m-p/439958#M3701 robettinger 2020-09-29T23:02:26Z https://community.splunk.com/t5/Monitoring-Splunk/internal-Index-not-indexing-application-log/m-p/439959#M3702 <P>Hi @robettinger </P> <P>This should work fine. I have my own log for my personal custom app and it writes to <CODE>/opt/splunk/var/log/splunk/my_app.log</CODE> and it is being read into _internal just fine - no additional inputs.conf stanzas required.</P> Thu, 31 Jan 2019 09:21:13 GMT https://community.splunk.com/t5/Monitoring-Splunk/internal-Index-not-indexing-application-log/m-p/439959#M3702 chrisyounger 2019-01-31T09:21:13Z