Getting Data In

Monitoring two different paths in inputs.conf, why am I only getting logs from one path, but not the second path?

pavanae
Builder

Hi the following is my inputs.conf

[monitor:///opt/jboss/server/*/log/server.log]
index = sit_2
sourcetype = log4j

[monitor:///opt/jboss/server/shared/logs/*/server.log]
index = sit_2
sourcetype = log4j

I am able to get logs from first path, but i wasn't able to get logs from the second path. I have checked whether the path is wrong, but i'ts correct and I also checked whether that path doesn't have splunk permissions, but it has permission.

I still can't see the logs from that particular path even though its seems everything was perfect.

Please tell me what might be the issue?

0 Karma
1 Solution

woodcock
Esteemed Legend

This will work:

[monitor:///opt/jboss/server/.../log/server.log]
index = sit_2
sourcetype = log4j

If that doesn't work then this is probably what is happening:

http://answers.splunk.com/answers/35210/crcsalt-issue.html

View solution in original post

woodcock
Esteemed Legend

This will work:

[monitor:///opt/jboss/server/.../log/server.log]
index = sit_2
sourcetype = log4j

If that doesn't work then this is probably what is happening:

http://answers.splunk.com/answers/35210/crcsalt-issue.html

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...