Getting Data In

Forwarding not working for some directories

Path Finder

I have a unix light forwarder that works fine for the normal default splunk forwarding (the scripts for CPU, ports, etc).

So:
[monitor:///var/log]
whitelist=(\.log|log$|messages$|mesg$|cron$|acpid$|\.out)
blacklist=(lastlog)
index=os
disabled = 0

Produces the expected entries on my indexer.

I added a statement for a custom directory (using a custom index):

[monitor:///services/.../logs]
whitelist=(\.log$|log$|messages$|mesg$|cron$|acpid$|\.out$)
blacklist=(lastlog$|\.gz$|^splunk|\.xml$|\.conf|^metrics)
index=services
disabled = 0

The index is created on the indexer, and 'splunk list monitor' shows the directories are being monitored on the forwarder (including many directories that shouldn't be, but I saw another question that answered that).

With all that, nothing new is added to my new index. What needs to happen to see my data on my indexer?

Splunk Employee
Splunk Employee

If possible, use Firefox to visit the Splunk forwarder's management port: https://fwder:8089/services/admin/inputstatus/TailingProcessor:FileStatus

And see what reason is provided for ignoring the files you wish to see indexed.

If it isn't possible to use Firefox, consider: wget --user=foo --password=bar https://localhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus | xmllint --format -

It's most likely just some collision with the regexes (using ... in a stanza creates an implicit whitelist). Let's see what the system thinks it's looking for.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!