Getting Data In

Monitor input error

franciscof
Explorer

Hi guys, I´ve been trying to add data on my HF and when I get to submit my input I receive this error:

franciscof_0-1602706509516.png

I do not know what "could not find writer for: /nobody/..." means...

Could you please help me figure it out?

Thanks in advance.

Labels (2)
0 Karma
1 Solution

rnowitzki
Builder

I don't have a good idea right now. 😕

The splunk user can read the file being monitored, right?

--
Karma and/or Solution tagging appreciated.

View solution in original post

0 Karma

rnowitzki
Builder

Hi @franciscof ,

You should find details in the splunkd.log
Try searching for esxifw.log, or maybe "nobody" around the time you tried to create the monitor.

Hope it helps.
BR
Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma

franciscof
Explorer

Hi, this is what I see when I check on the logs from the splunkd.log

uas nsx error.PNG

Still think this is a little unclear. What do you think?

0 Karma

rnowitzki
Builder

I don't have a good idea right now. 😕

The splunk user can read the file being monitored, right?

--
Karma and/or Solution tagging appreciated.
0 Karma

franciscof
Explorer

That was the issue, root had permissions on the directory, thanks for you help

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...