Getting Data In

Monitor input error

franciscof
Explorer

Hi guys, I´ve been trying to add data on my HF and when I get to submit my input I receive this error:

franciscof_0-1602706509516.png

I do not know what "could not find writer for: /nobody/..." means...

Could you please help me figure it out?

Thanks in advance.

Labels (2)
0 Karma
1 Solution

rnowitzki
Builder

I don't have a good idea right now. 😕

The splunk user can read the file being monitored, right?

--
Karma and/or Solution tagging appreciated.

View solution in original post

0 Karma

rnowitzki
Builder

Hi @franciscof ,

You should find details in the splunkd.log
Try searching for esxifw.log, or maybe "nobody" around the time you tried to create the monitor.

Hope it helps.
BR
Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma

franciscof
Explorer

Hi, this is what I see when I check on the logs from the splunkd.log

uas nsx error.PNG

Still think this is a little unclear. What do you think?

0 Karma

rnowitzki
Builder

I don't have a good idea right now. 😕

The splunk user can read the file being monitored, right?

--
Karma and/or Solution tagging appreciated.
0 Karma

franciscof
Explorer

That was the issue, root had permissions on the directory, thanks for you help

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...