Monitor file is not working on unix

[722624]

1. I have splunk installed on *nix server
2. created a folder 'splunk_monitor' in folder '/opt/splunk' ..given owner as same as splunk installed

3. my inputs.conf file updated with below content
   [monitor:/$SPLUNKHOME/splunkmonitor]
   index =
   sourcetype =

4. this is not indexing any files, I cant see any events in search ..

5. I tried searching with sourcetype, index, source etc...with many combinations.. still no result

6. I tried checking few log files splunkd.log etc..

Please guide me how can I trouble shoot
Thank you

Amarander Busireddy

[ddrillic]

We can start with I can't find my data!

[hunters_splunk · Accepted solution]

Hi Amarander,

Please try adding a monitor input using CLI, for example:

./splunk add monitor /var/log/  -index newindex

For details, please refer to documentation: http://docs.splunk.com/Documentation/Splunk/6.5.1/Data/MonitorfilesanddirectoriesusingtheCLI

Hope this helps. Thanks!
Hunter