Getting Data In

Splunk_TA_nix local inputs.conf not allowing multiple indexes

diptij
Path Finder

I created a Splunk_TA_nix/local/inputs.conf.

I created 2 different indexes in indexes.conf.  And then I created an inputs.conf and monitored 2 directories with 2 different indexes with same sourcetype.

I put files in the directories.

But the 2nd index doesn't get data in.  

Help please

Labels (1)
0 Karma

anilchaithu
Builder

@diptij 

Can you please share your monitor stanza? Did you check splund logs for any errors?

It should not depend the add-on. It only depends on

1) The user running splunk on the server must have read permissions to the directories.

2) monitor stanza should be error free

0 Karma

diptij
Path Finder

Thank-you Anil for responding.

I was ingesting too many files and the indexing/ingesting was taking a lot of time. 

I was looking at the output of 'splunk list inputstatus'  https://localhost:8089/services/admin/inputstatus to see what the status of the indexing was:  the file position showed as 0 and status as File was read.  So, it wasn't conclusive as to what was happening. 

0 Karma

anilchaithu
Builder

@diptij 

If its with the data volume, try to increase the throughput to 512kbps OR more (default is 256kbps) for debug purpose and see if this resolves. we went upto 4096kbps for one of the use case.

Is there any errors in the log messages?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...