- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I configured inputs.conf in Splunk free to monitor different app log files, but why am I unable to view the data in Splunk Web?
HI,
I am new to Splunk. Apologies if the same question was asked earlier. I am posting here as I couldn't find the answer to the issue I am facing.
I have to monitor 10 to 15 different app logs in my var/logs directory
[monitor:///var/log/orchestration-component.log]
disabled = false
index = brdigegap
sourcetype = orchestration
When I give my stanza as above, Splunk is unable to parse/ index the log files and on Splunk Web it doesn't show the log files or sources.
FYI: I am using free version of Splunk.
1- user does have access/admin access to check view data in the index and
2- index is created in Splunk already.
Not sure why exactly Splunk Web is not showing.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The Splunk free version has daily license limit of 500 MB. Have you already exceeded that? Does the user under which Splunk is running has access to logs? Check the monitoring path as well (linux is case sensitive) ? Check the errors in 'index=_internal sourcetype=splunkd' for these logs?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@somesoni2
yes. 500mb limit has reached . Does splunk wont process/index the log files when it exceeds 500mb?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

When the license limit is reached, Splunk continues to index the data, but disables the search capability.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


you might check the /var/log/splunk/*.log files to see if there are any warnings or errors related to the inputs you defined.
