I configured inputs.conf in Splunk free to monitor different app log files, but why am I unable to view the data in Splunk Web?

[murthychitturi]

HI,

I am new to Splunk. Apologies if the same question was asked earlier. I am posting here as I couldn't find the answer to the issue I am facing.

I have to monitor 10 to 15 different app logs in my var/logs directory

[monitor:///var/log/orchestration-component.log]
disabled = false
index = brdigegap
sourcetype = orchestration

When I give my stanza as above, Splunk is unable to parse/ index the log files and on Splunk Web it doesn't show the log files or sources.

FYI: I am using free version of Splunk.
1- user does have access/admin access to check view data in the index and
2- index is created in Splunk already.

Not sure why exactly Splunk Web is not showing.

[somesoni2]

The Splunk free version has daily license limit of 500 MB. Have you already exceeded that? Does the user under which Splunk is running has access to logs? Check the monitoring path as well (linux is case sensitive) ? Check the errors in 'index=_internal sourcetype=splunkd' for these logs?

[murthychitturi]

@somesoni2

yes. 500mb limit has reached . Does splunk wont process/index the log files when it exceeds 500mb?

[lguinn2]

When the license limit is reached, Splunk continues to index the data, but disables the search capability.

[jterry]

you might check the /var/log/splunk/*.log files to see if there are any warnings or errors related to the inputs you defined.