Getting Data In

Where is the data for my monitor file var/log/zimbra.log file?

vumanhtai
Path Finder

I set up a monitor zimbra.log file, but I find it is missing the data pushed to the Splunk server compared to the actual file it has.
How do I have to deal with this problem?

0 Karma

ShaneNewman
Motivator

If I had to guess, I would say that you probably have the Splunk TA for linux installed, which monitors /var/log... This is a crap monitor stanza and is most likely causing a conflict with your monitor stanza. Add a blacklist to that /var/log monitor stanza for zimbra logs.

0 Karma

ShaneNewman
Motivator

If my theory is correct, you can search the os index for source=/var/log/zimbra.log and you will see data, unless you changed the name of the index from os to something else.

0 Karma

risgupta
Path Finder

Could you please help with Splunkd.log files for the Zimbra mail server where splunk is installed.

0 Karma

mayurr98
Super Champion

try putting crcSalt = abc in inputs.conf

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...