Cant find data added through inputs.conf

[vaishnavi07]

I tried adding the data through inputs.conf. I am trying to add sample log file from my system to the splunk server. I added the below code to inputs.conf and restarted the server but i dont find any data in my index.

[monitor://C:\Windows\WindowsUpdate.log]
disabled=0
index=windowsupdate_test
sourcetype=windowsupdate

Does anyone know what may be the issue here? Thanks in advance.

[thambisetty]

Hi Vaishavai07,

May I know Operating system of the forwarder splunk instance and Receiver splunk instance ( Indexer)?,hi vaishnavi,
may I know from which OS you want to get the data in? OR OS of the forwarder?
on which OS u have installed splunk server? OR OS of the Indexer(Receiver)?

OS - operating SYstem

[vaishnavi07]

Splunk is installed on linux machine. I am only trying to add the file by adding stanza in inputs.Conf but it is showing error as pathbis not absolute.

[MuS]

You cannot add a windows path as input on a lunix server. If you just want to index the file, copy it over to this directory on the Splunk Indexer $SPLUNK_HOME/var/spool/splunk everything in there will be indexed automatically.

[splunker12er]

Did you search for all time?
Did you see any errors at splunkd.log ?
Are you using universal forwarder ?
- Check for the outputs.conf file for the correct IP of the indexer your are forwarding .

[vaishnavi07]

Yes i searched for all time. I only need to add data into my server. For now i am not forwarding the data to any othere server.

[MuS]

Hi vaishnavi07,

there is a long list of possible issues here:

• does the user running splunk have read rights on this file?
• can you reach the index server from the UF (if you're using an UF, which is an universal forwarder)?
• did you check on the source, where you changed the inputs.conf, in $SPLUNK_HOME\var\log\splunk\splunkd.log for any errors?
• did you do an all time search on the index=windowsupdate_test ?
• do you have the permission do search this index?
• does this index exist?
• typos anywhere?
• .......

hope this helps to get you started

cheers, MuS

[vaishnavi07]

Yes am running on linux. Is it not the format?

[vaishnavi07]

it is located in $SPLUNK_HOME$/etc/system/local. I checked for the typos but everything is fine.Whatever i have posted in the question is what i have given there.

[MuS]

run $SPLUNK_HOME\bin\splunk cmd btool --debug inputs list monitor and check if your monitor stanza is listed

[vaishnavi07]

When i run the command it shows that $SPLUNK_HOME should be set. But when i checked in splunk-launch.conf the SPLUNK_HOME is set correctly.

[vaishnavi07]

When i check splunkd.log it is showing error as path is not aboslute.

[jrodman]

For a monitor line such as
[monitor://C:\Windows\WindowsUpdate.log] you will get an error that it is not absolute if you are running on UNIX. Are you running on UNIX?

[vaishnavi07]

Hi Jrodman. Can you tell me the format as to how i should provide the path?

[vaishnavi07]

When i try adding the same file through UI page it is working. But when i add it through inputs.conf i am not getting the data.

[vaishnavi07]

Yes that is fine. Even when i add new data it is not getting added. Anything through inputs.conf is not adding.

[MuS]

where is this inputs.conf located? check for typos in that file

[MuS]

you are aware the fact, that once indexed data will not be re-indexed by Splunk simply because you add once again using a different method? You have to clean the so called fishbucket first, this is where Splunk saves what already was indexed.

[vaishnavi07]

The index name is also not there in the splunkd.log. Does this mean there are no errors or it dint add the data at all?

[MuS]

did you created an index called windows update_test?

[vaishnavi07]

Yes i have read rights on the file. I checked in splunkd.log and there are no entries in it. And also i did an All time search on the index. I have admin rights on the server and i have write permissions on this index.