Getting Data In

Best way to debug indexing based on props.conf

Dark_Ichigo
Builder

Im having issues and I know its related to props.conf, but I have over 100 regexes and I dont want to test each one, is there a log file that I can follow to monitor why its not indexing?

Iv tried using Splunkd.log, but it doesnt say much about my current issue.

0 Karma

splunkIT
Splunk Employee
Splunk Employee

Specifically, what is the issue you are having? You can enable debug logging on splunk, but I am not sure if is necessary for your issue. More information on debug logging here:

http://docs.splunk.com/Documentation/Splunk/4.3.4/Troubleshooting/Enabledebuglogging#Enable_debug_lo...

Dark_Ichigo
Builder

I just went through each regex one by one and found the odd one out, dodgy and took over 5 hours, but I got it.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!