https://community.splunk.com/t5/Monitoring-Splunk/Data-preview-option-is-missing/m-p/333047#M5463 <P>Hi htidore!</P> <P>Glad to see you using add data wizard. It is a very useful way to ensure you build your sourcetypes right!</P> <P>As the warning explicitly advises, data preview is skipped for directories. It has been this way as long as I can remember. It is not an issue, it is expected behavior. It cannot traverse multiple directories/deal with multiple files at once. You can still build the input this way, just can't test your props. </P> <P>If you are trying to use it to build props, the best way around it is to start the data wiz as if you are working with a single file in the dir, navigate to a single file, set up the props the way you want, then use the "copy to clipboard" option to save the props settings you need, then cancel out of the wizard. </P> <P>You can then go back thru the wizard to enable the input if you need to, after you put your props in the correct app. </P> Sun, 10 Dec 2017 17:05:35 GMT mattymo 2017-12-10T17:05:35Z https://community.splunk.com/t5/Monitoring-Splunk/Data-preview-option-is-missing/m-p/333046#M5462 <P>My environment is Splunk version 7.01 on MacOS Sierra.</P> <P>When I try to monitor a folder (during configuration Settings &gt; Data Inputs &gt; Files and Directories), it gives me an error :</P> <P><IMG src="https://community.splunk.com/storage/temp/218990-screen-shot-2017-12-10-at-114030-pm.png" alt="alt text" /></P> <P>I only start having this problem after upgrading my laptop to MacOS Sierra with APFS. I have also entered the following line into $SPLUNK_HOME/etc/splunk-launch.conf<BR /> <CODE>OPTIMISTIC_ABOUT_FILE_LOCKING = 1</CODE><BR /> Without the above entry, Splunk cannot start.</P> <P>My question is how come Data preview is skipped? Any way to fix this problem?</P> <P>Thanks.<BR /> Hanny.</P> Tue, 29 Sep 2020 17:10:51 GMT https://community.splunk.com/t5/Monitoring-Splunk/Data-preview-option-is-missing/m-p/333046#M5462 htidore 2020-09-29T17:10:51Z https://community.splunk.com/t5/Monitoring-Splunk/Data-preview-option-is-missing/m-p/333047#M5463 <P>Hi htidore!</P> <P>Glad to see you using add data wizard. It is a very useful way to ensure you build your sourcetypes right!</P> <P>As the warning explicitly advises, data preview is skipped for directories. It has been this way as long as I can remember. It is not an issue, it is expected behavior. It cannot traverse multiple directories/deal with multiple files at once. You can still build the input this way, just can't test your props. </P> <P>If you are trying to use it to build props, the best way around it is to start the data wiz as if you are working with a single file in the dir, navigate to a single file, set up the props the way you want, then use the "copy to clipboard" option to save the props settings you need, then cancel out of the wizard. </P> <P>You can then go back thru the wizard to enable the input if you need to, after you put your props in the correct app. </P> Sun, 10 Dec 2017 17:05:35 GMT https://community.splunk.com/t5/Monitoring-Splunk/Data-preview-option-is-missing/m-p/333047#M5463 mattymo 2017-12-10T17:05:35Z