Getting Data In

Best way to debug indexing based on props.conf

Dark_Ichigo
Builder

Im having issues and I know its related to props.conf, but I have over 100 regexes and I dont want to test each one, is there a log file that I can follow to monitor why its not indexing?

Iv tried using Splunkd.log, but it doesnt say much about my current issue.

0 Karma

splunkIT
Splunk Employee
Splunk Employee

Specifically, what is the issue you are having? You can enable debug logging on splunk, but I am not sure if is necessary for your issue. More information on debug logging here:

http://docs.splunk.com/Documentation/Splunk/4.3.4/Troubleshooting/Enabledebuglogging#Enable_debug_lo...

Dark_Ichigo
Builder

I just went through each regex one by one and found the odd one out, dodgy and took over 5 hours, but I got it.

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...