I configured inputs.conf,my data can't indexed,but on UI i can add the data.
/opt/splunk/etc/apps/$APP/local
indexes.conf
[_cpu]
coldPath = $SPLUNK_DB/_cpu/colddb
homePath = $SPLUNK_DB/_cpu/db
thawedPath = $SPLUNK_DB/_cpu/thaweddb
inputs.conf
[monitor:///root/date/CPU_.dat]
disabled = false
followTail = 0
host =
host_regex = (?i).?(?P
index = _cpu
sourcetype = cpuinfo
/opt/splunk/etc/system/local/
props.conf
[cpuinfo]
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
pulldown_type = 1
When i search "index=_cpu", event is 0.i don't know why? who can help me?
Index names should not begin with "_".
Check access roles permission for the user logged in and check if the user has permission to use this index
thank you!but i have only user admin,what files i should configure?