Getting Data In

I configured inputs.conf,but my data can't indexed?

laiyongmao
Path Finder

I configured inputs.conf,my data can't indexed,but on UI i can add the data.

/opt/splunk/etc/apps/$APP/local

indexes.conf
[_cpu]
coldPath = $SPLUNK_DB/_cpu/colddb
homePath = $SPLUNK_DB/_cpu/db
thawedPath = $SPLUNK_DB/_cpu/thaweddb

inputs.conf
[monitor:///root/date/CPU_.dat]
disabled = false
followTail = 0
host =
host_regex = (?i).
?(?P\d+.\d+.\d+.\d+)_
index = _cpu
sourcetype = cpuinfo

/opt/splunk/etc/system/local/
props.conf
[cpuinfo]
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
pulldown_type = 1

When i search "index=_cpu", event is 0.i don't know why? who can help me?

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

Index names should not begin with "_".

View solution in original post

lguinn2
Legend

Index names should not begin with "_".

ajaysamantbms
Explorer

Check access roles permission for the user logged in and check if the user has permission to use this index

0 Karma

laiyongmao
Path Finder

thank you!but i have only user admin,what files i should configure?

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...