Where is the data for my monitor file var/log/zimbra.log file?

[vumanhtai]

I set up a monitor zimbra.log file, but I find it is missing the data pushed to the Splunk server compared to the actual file it has.
How do I have to deal with this problem?

[ShaneNewman]

If I had to guess, I would say that you probably have the Splunk TA for linux installed, which monitors /var/log... This is a crap monitor stanza and is most likely causing a conflict with your monitor stanza. Add a blacklist to that /var/log monitor stanza for zimbra logs.

[ShaneNewman]

If my theory is correct, you can search the os index for source=/var/log/zimbra.log and you will see data, unless you changed the name of the index from os to something else.

[risgupta]

Could you please help with Splunkd.log files for the Zimbra mail server where splunk is installed.

[mayurr98]

try putting crcSalt = abc in inputs.conf