All Apps and Add-ons

File monitoring not working

tomapatan
Communicator
My inputs.conf on the rasberryPi look like this:

 

[monitor:///var/log/pihole.log]
disabled = 0
sourcetype = pihole
index = main

[monitor:///var/log/pihole-FTL.log]
disabled = 0
sourcetype = pihole:ftl
index = main

 

 
Both log files exist in /var/log, but only one sourcetype gets sent to my indexer and that`s "pihole:ftl".
Any assistance would be greatly appreciated.
Labels (1)
0 Karma
1 Solution

tomapatan
Communicator

Hi @gcusello ,

Thanks for getting back to me. Turns out the splunk user did not have access to the pihole.log, only to the pihole-FTL.log files.

Splunk started to ingest both files after I changed the permissions.

Thanks,

Toma.

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @tomapatan,

check if the two files have the same content, even if a different name: Splunk doesn't index twice the same log.

If this is the issue, you can use crcSalt = <SOURCE> option in inputs.conf to index both files.

[monitor:///var/log/pihole.log]
disabled = 0
sourcetype = pihole
index = your_index
crcSalt = <SOURCE>
 
[monitor:///var/log/pihole-FTL.log]
disabled = 0
sourcetype = pihole:ftl
index = your_index
crcSalt = <SOURCE>

One additional my personal hint: don't use main index, create a custom one: not many indexes, few ones but not main.

Ciao.

Giuseppe

tomapatan
Communicator

Hi @gcusello ,

Thanks for getting back to me. Turns out the splunk user did not have access to the pihole.log, only to the pihole-FTL.log files.

Splunk started to ingest both files after I changed the permissions.

Thanks,

Toma.

Get Updates on the Splunk Community!

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...