Getting Data In

Splunk_TA_nix local inputs.conf not allowing multiple indexes

diptij
Path Finder

I created a Splunk_TA_nix/local/inputs.conf.

I created 2 different indexes in indexes.conf.  And then I created an inputs.conf and monitored 2 directories with 2 different indexes with same sourcetype.

I put files in the directories.

But the 2nd index doesn't get data in.  

Help please

Labels (1)
0 Karma

anilchaithu
Builder

@diptij 

Can you please share your monitor stanza? Did you check splund logs for any errors?

It should not depend the add-on. It only depends on

1) The user running splunk on the server must have read permissions to the directories.

2) monitor stanza should be error free

0 Karma

diptij
Path Finder

Thank-you Anil for responding.

I was ingesting too many files and the indexing/ingesting was taking a lot of time. 

I was looking at the output of 'splunk list inputstatus'  https://localhost:8089/services/admin/inputstatus to see what the status of the indexing was:  the file position showed as 0 and status as File was read.  So, it wasn't conclusive as to what was happening. 

0 Karma

anilchaithu
Builder

@diptij 

If its with the data volume, try to increase the throughput to 512kbps OR more (default is 256kbps) for debug purpose and see if this resolves. we went upto 4096kbps for one of the use case.

Is there any errors in the log messages?

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...