I am importing the data through the inputs.conf file :
[default] host = XXXXXXXXXX [monitor://C:\Users\lg133108\Desktop\NEW_TEST] disabled = false crcSalt=<SOURCE> index = upload_data_new sourcetype = mysource_new
when I am going to search for my data :
index="uploaddatanew" , I am seeing 0 events ..please suggest me how to resolve this problem.
Please help !!
Check your time range? If you're indexing historical data, the time range might not include those events.
Does the index exist? Splunk won't create it for you, based on inputs.conf alone; you have to create the index first.
I have given the time range as "All time", yes ofcourse my data is historical data.
I created the index first then configured the inputs.conf and restarted the system..
Please help me in this regards,
I've noticed Splunk can be really picky when it comes to search.
This may be silly but what do you get if you try
host=xxxxxxxx index=upload_date_new sourcetype=mysource_new
I've had issues with search and noticed that sometimes I won't get any results unless i type the whole shabang. I guess its pickiness is what makes it so intuitive once you get to a higher level :S