Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Monitor a directory for new files
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Monitor a directory for new files
Hi,
I am trying to monitor a directory.
Suppose that there is a directory named test and it contains initially a log file called access.log.
The access.log file contains following data.
210.160.24.63 - - [07/May/2015:18:22:16] "GET /product.screen?productId=WC-SH-A02&JSESSIONID=SD0SL6FF7ADFF4953 HTTP 1.1" 200 3878 "http://www.google.com" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5" 349
.....
.....
It is showing that 13,628 events are indexed.
Now i added an another file access1.log in same directory (test). with little with changes in the file. I have replace 210.160.24.63 with 190.160.24.63 and all other contents are same as it is.
But still in search It is showing that 13,628 events .
I have checked that through CLI that both files are listed in monitor directory.
But i am not getting expected results i.e. events should be increased.
Please help me .
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
add crcSalt = under your monitor stanza
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are the first few lines of the documents exactly the same? Or did the change of the ip influence the also the first few lines of the document?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No the first line of the document is not exactly same.
I have already mentioned that the first line stated with 210.160.24.63 ... is replaced with 190.160.24.63 and rest of are exactly same.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok, sorry but from your post it was not completely clear for me that you changed the first line.
Can you provide the corresponding monitoring stanza from your inputs.conf ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
[monitor://D:/\Splunk Data/\Testing]
disabled = true
index = splunk_test
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Your input is disabled, change to disabled = false.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have changed to disabled = false.
Still i am getting same result.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you changed this setting in the default or in the local directory? Can you find your input in the web ui? In the web ui and in the correct app context go to settings -> data inputs -> files and directories. Is your input in this list and displayed as "enabled"?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have made changes in C:\Program Files\Splunk\etc\apps\search\local\inputs.conf.
i have aslo gone through web ui. I found there status= enabled and no. of file = 1.
Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain
Splunk Lantern’s Guide to The Most Popular .conf25 Sessions
Unlock What’s Next: The Splunk Cloud Platform at .conf25
