Deployment Architecture

Indexing text based .dat files using UF install

dchodur
Path Finder

I was using a HF before and wanted to switch to a UF. I had a props.conf file in the etc/system/local with this:
[source::....(dat)]
sourcetype = mysourcetype
priority = 20

I am not not getting the newly installed UF to index the files. The reason to switch was we are not not doing anything else but read the file and forward on. Also was moving this to be managed by deployment server as well. Thanks.

0 Karma
1 Solution

dchodur
Path Finder

Actually this is working now. Looks like just some delay in getting the confs to come all in and data be read. Was just concerned when I was not seeing this that the props.conf file was being completely ignored due to being a UF.

View solution in original post

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

look here:

http://wiki.splunk.com/Community:Troubleshooting_Monitor_Inputs

In Splunk 4.1 and later, you can access a debugging endpoint that shows status information about monitored files. https://your-splunk-server:8089/services/admin/inputstatus/TailingProcessor:FileStatus Note that this may change in the future, and is a somewhat rough prototype of the monitor behavior inspection.

0 Karma

dchodur
Path Finder

Thanks for the info, will help in the future. BTW - like the FileStatus. Looks like if UI is off (which it is on UF) then cannot use it.

0 Karma

dchodur
Path Finder

Actually this is working now. Looks like just some delay in getting the confs to come all in and data be read. Was just concerned when I was not seeing this that the props.conf file was being completely ignored due to being a UF.

0 Karma

chris
Motivator

Are you not seeing the files at all or is the sourcetype not assigned correctly? If the props stanza fails (I dont see why) then the inputs specified in inputs.conf should still be read and forwarded.

0 Karma
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...