Getting Data In

Monitor input error

franciscof
Explorer

Hi guys, I´ve been trying to add data on my HF and when I get to submit my input I receive this error:

franciscof_0-1602706509516.png

I do not know what "could not find writer for: /nobody/..." means...

Could you please help me figure it out?

Thanks in advance.

Labels (2)
0 Karma
1 Solution

rnowitzki
Builder

I don't have a good idea right now. 😕

The splunk user can read the file being monitored, right?

--
Karma and/or Solution tagging appreciated.

View solution in original post

0 Karma

rnowitzki
Builder

Hi @franciscof ,

You should find details in the splunkd.log
Try searching for esxifw.log, or maybe "nobody" around the time you tried to create the monitor.

Hope it helps.
BR
Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma

franciscof
Explorer

Hi, this is what I see when I check on the logs from the splunkd.log

uas nsx error.PNG

Still think this is a little unclear. What do you think?

0 Karma

rnowitzki
Builder

I don't have a good idea right now. 😕

The splunk user can read the file being monitored, right?

--
Karma and/or Solution tagging appreciated.
0 Karma

franciscof
Explorer

That was the issue, root had permissions on the directory, thanks for you help

0 Karma
Get Updates on the Splunk Community!

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...