Getting Data In

File and Dir File Monitoring not working?

DesertSocBum
Explorer

Setup an app folder on my search head (clustered with indexers and HECS)  "TA-Whatever"  from the app builder. Dropped a  py script in the default folder inside TA-whatever that gens a json file that gets dropped in the parent app TA-whatever folder. 

When going to the add data, file and directory menu, I wen thru the server file system drop downs and selected the  json file and on the 2nd page where you select the sourcetype it sees the  json data.  After I select my index, source type and all that, finish, restart Splunk, and search the index,  I see nothing, no data is there.

 

I have rebuilt the app several times as the Splunk user,  as root.  chmod everything to 777. rebuild source types and index's. did props conf, treid with no entry in props.  added inputs conf to the local app folder, tried with no input.conf in the ta-whatever local folder,  also added a monitor to the global inputs.conf in etc/sys/local and still no dice.

 

here is my input.conf that i tried in global and the local app directory:

[monitor://tmp/felt.json]
disabled = 0
index = googlepyscript
sourcetype = googlepy

 

also tried:

 

[monitor:///tmp/felt.json]
disabled = 0
index = googlepyscript
sourcetype = googlepy

 

 

No matter what I do the index is not getting data. I have tried it with the build in _json sourcetype and created my own and no data goes to the index after I finish the wizard.   Any input is welcomed at this point as I have been going at it for several days. Thanks! 

Labels (2)
0 Karma
1 Solution

DesertSocBum
Explorer

I have solved this sort of.. for some reason the new index I created wont take data. Once I re-did all this and pointed it to an older index it started to work. 

View solution in original post

0 Karma

DesertSocBum
Explorer

I have solved this sort of.. for some reason the new index I created wont take data. Once I re-did all this and pointed it to an older index it started to work. 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Enterprise Security: An Automated Phishing Response Workflow

Originally posted on Splunk.com.   Key takeaways  The volume of phishing emails can overwhelm even the most ...

Sharper ES Detections, Agentic AI Integrations, Smarter Workload Management, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Data Outage Monitoring and Reporting

We’ve all been there, right? Living our best life, working on our Splunk environment, when out of nowhere a ...