Indexed Data

[whitecat001]

I made my configuration for inputs.conf to ingest data into splunk but not getting data, during my investigation to check if there is any issue i realize the configured source is not showing any data and i cant see the source path in the index in splunk. Is there a reason why am not seeing the source after configuring the inputs.conf 

[deepakc]

It could be a n umber of things as to why the data is not coming through or not showing.

1.Whatever your monitoring does it have read permissions?
2.Check for typos' (index name etc)

You can also check the internal logs for clues

index=_internal sourcetype=splunkd host=neo log_level=INFO component=WatchedFile 
| table host, _time, component, event_message, log_level
| sort - _time

What is the output of this command - it shows whats being monitored (Assuming its a linux host)

/opt/splunk/bin/splunk list inputstatus

Are you able to show us your inputs.conf and describe what you are trying to monitor?