I am new to Splunk. Apologies if the same question was asked earlier. I am posting here as I couldn't find the answer to the issue I am facing.
I have to monitor 10 to 15 different app logs in my var/logs directory
[monitor:///var/log/orchestration-component.log] disabled = false index = brdigegap sourcetype = orchestration
When I give my stanza as above, Splunk is unable to parse/ index the log files and on Splunk Web it doesn't show the log files or sources.
FYI: I am using free version of Splunk.
1- user does have access/admin access to check view data in the index and
2- index is created in Splunk already.
Not sure why exactly Splunk Web is not showing.
The Splunk free version has daily license limit of 500 MB. Have you already exceeded that? Does the user under which Splunk is running has access to logs? Check the monitoring path as well (linux is case sensitive) ? Check the errors in 'index=_internal sourcetype=splunkd' for these logs?