I am perplexed with what I'm experiencing right now.
I have all the file inputs enabled for monitor but I'm not seeing them at the Sources and Sourcetypes columns. I have also confirmed it at the Manager page that the inputs are enabled; and also the inputs.conf that the disabled=0
Any idea why this is happening?
Possible problems:
Enabling debugging may tell you more and you can also list the monitored files:
>./splunk list monitor
Possible problems:
Enabling debugging may tell you more and you can also list the monitored files:
>./splunk list monitor
my mistake ... apparently i totally forgotten that I configured forwarding & receiving (which the indexing is disabled by default a the forwarder)