Archive

Monitor file is not working on unix

Path Finder
  1. I have splunk installed on *nix server
  2. created a folder 'splunk_monitor' in folder '/opt/splunk' ..given owner as same as splunk installed
  3. my inputs.conf file updated with below content
    [monitor:/$SPLUNKHOME/splunkmonitor]
    index =
    sourcetype =

  4. this is not indexing any files, I cant see any events in search ..

  5. I tried searching with sourcetype, index, source etc...with many combinations.. still no result

  6. I tried checking few log files splunkd.log etc..

Please guide me how can I trouble shoot
Thank you

Amarander Busireddy

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Hi Amarander,

Please try adding a monitor input using CLI, for example:

./splunk add monitor /var/log/  -index newindex

For details, please refer to documentation: http://docs.splunk.com/Documentation/Splunk/6.5.1/Data/MonitorfilesanddirectoriesusingtheCLI

Hope this helps. Thanks!
Hunter

View solution in original post

0 Karma

Ultra Champion

We can start with I can't find my data!

0 Karma

Splunk Employee
Splunk Employee

Hi Amarander,

Please try adding a monitor input using CLI, for example:

./splunk add monitor /var/log/  -index newindex

For details, please refer to documentation: http://docs.splunk.com/Documentation/Splunk/6.5.1/Data/MonitorfilesanddirectoriesusingtheCLI

Hope this helps. Thanks!
Hunter

View solution in original post

0 Karma