Getting Data In
Highlighted

Splunk_TA_nix local inputs.conf not allowing multiple indexes

Loves-to-Learn Lots

I created a Splunk_TA_nix/local/inputs.conf.

I created 2 different indexes in indexes.conf.  And then I created an inputs.conf and monitored 2 directories with 2 different indexes with same sourcetype.

I put files in the directories.

But the 2nd index doesn't get data in.  

Help please

Labels (1)
0 Karma
Highlighted

Re: Splunk_TA_nix local inputs.conf not allowing multiple indexes

Communicator

@diptij 

Can you please share your monitor stanza? Did you check splund logs for any errors?

It should not depend the add-on. It only depends on

1) The user running splunk on the server must have read permissions to the directories.

2) monitor stanza should be error free

0 Karma
Highlighted

Re: Splunk_TA_nix local inputs.conf not allowing multiple indexes

Loves-to-Learn Lots

Thank-you Anil for responding.

I was ingesting too many files and the indexing/ingesting was taking a lot of time. 

I was looking at the output of 'splunk list inputstatus'  https://localhost:8089/services/admin/inputstatus to see what the status of the indexing was:  the file position showed as 0 and status as File was read.  So, it wasn't conclusive as to what was happening. 

0 Karma
Highlighted

Re: Splunk_TA_nix local inputs.conf not allowing multiple indexes

Communicator

@diptij 

If its with the data volume, try to increase the throughput to 512kbps OR more (default is 256kbps) for debug purpose and see if this resolves. we went upto 4096kbps for one of the use case.

Is there any errors in the log messages?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.