Getting Data In

Monitor input error

franciscof
Explorer

Hi guys, I´ve been trying to add data on my HF and when I get to submit my input I receive this error:

franciscof_0-1602706509516.png

I do not know what "could not find writer for: /nobody/..." means...

Could you please help me figure it out?

Thanks in advance.

Labels (2)
0 Karma
1 Solution

rnowitzki
Builder

I don't have a good idea right now. 😕

The splunk user can read the file being monitored, right?

--
Karma and/or Solution tagging appreciated.

View solution in original post

0 Karma

rnowitzki
Builder

Hi @franciscof ,

You should find details in the splunkd.log
Try searching for esxifw.log, or maybe "nobody" around the time you tried to create the monitor.

Hope it helps.
BR
Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma

franciscof
Explorer

Hi, this is what I see when I check on the logs from the splunkd.log

uas nsx error.PNG

Still think this is a little unclear. What do you think?

0 Karma

rnowitzki
Builder

I don't have a good idea right now. 😕

The splunk user can read the file being monitored, right?

--
Karma and/or Solution tagging appreciated.
0 Karma

franciscof
Explorer

That was the issue, root had permissions on the directory, thanks for you help

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...