Getting Data In

Unable to find the source file

dhs_harry08
Path Finder

hi,

I have this source showing in the splunk source=/opt/splunk/var/spool/splunk/singlehost.sample.sav

But when I checked the server I am unable to find this particular file. How is this possible.

If I want to find the source in this case how can I do it. For example if the data is coming through a network port.

Regards,
Harish

Tags (3)
0 Karma
1 Solution

dhs_harry08
Path Finder

I found the solution at last. These events were generated by an app by splunk SA-Eventgen. We were using PCI compliance app and while installation it seems this app was configured by default. After disabling the app these sample logs disappeared.

I found the solution in the Splunk security app FAQs.
http://docs.splunk.com/Documentation/ES/2.4/User/FAQ#How_do_I_manually_enable_eventgen.3F

But the same is not included in PCI compliance app documentation. Hope splunk sees this and update the PCI compliance app documentation.

Regards,
Harish

View solution in original post

0 Karma

dhs_harry08
Path Finder

I found the solution at last. These events were generated by an app by splunk SA-Eventgen. We were using PCI compliance app and while installation it seems this app was configured by default. After disabling the app these sample logs disappeared.

I found the solution in the Splunk security app FAQs.
http://docs.splunk.com/Documentation/ES/2.4/User/FAQ#How_do_I_manually_enable_eventgen.3F

But the same is not included in PCI compliance app documentation. Hope splunk sees this and update the PCI compliance app documentation.

Regards,
Harish

View solution in original post

0 Karma

dhs_harry08
Path Finder

Is it possible to stop the files (/opt/splunk/var/spool/splunk/singlehost.sample.sav) from getting indexed.

0 Karma

Ayn
Legend

The data source just says where Splunk got the data from at the time of indexing. It doesn't say anything about the current status of that source.

In your particular case, the source is a file in Splunk's spool directory - files that are put in this directory are immediately deleted after they've been indexed.

0 Karma

Ayn
Legend

Easiest thing would be to make whatever is putting the files there in the first place stop what it's doing.

0 Karma

dhs_harry08
Path Finder

Is it possible to stop the files (/opt/splunk/var/spool/splunk/singlehost.sample.sav) from getting indexed

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.