Getting Data In

Monitor input error

franciscof
Explorer

Hi guys, I´ve been trying to add data on my HF and when I get to submit my input I receive this error:

franciscof_0-1602706509516.png

I do not know what "could not find writer for: /nobody/..." means...

Could you please help me figure it out?

Thanks in advance.

Labels (2)
0 Karma
1 Solution

rnowitzki
Builder

I don't have a good idea right now. 😕

The splunk user can read the file being monitored, right?

--
Karma and/or Solution tagging appreciated.

View solution in original post

0 Karma

rnowitzki
Builder

Hi @franciscof ,

You should find details in the splunkd.log
Try searching for esxifw.log, or maybe "nobody" around the time you tried to create the monitor.

Hope it helps.
BR
Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma

franciscof
Explorer

Hi, this is what I see when I check on the logs from the splunkd.log

uas nsx error.PNG

Still think this is a little unclear. What do you think?

0 Karma

rnowitzki
Builder

I don't have a good idea right now. 😕

The splunk user can read the file being monitored, right?

--
Karma and/or Solution tagging appreciated.
0 Karma

franciscof
Explorer

That was the issue, root had permissions on the directory, thanks for you help

0 Karma
Get Updates on the Splunk Community!

Get Schooled with Splunk Education: Explore Our Latest Courses

At Splunk Education, we’re dedicated to providing incredible learning experiences that cater to every skill ...

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...