Getting Data In

Why am I unable to read logfiles?

twh1
Communicator

I am trying to read log files from a server. I have made all the configuration in Splunk but data is not coming in Splunk search. When I checked Splunk's internal log, I got a permission denied error for that server. I logged to the specific server and verified that all users have read permission to path I am trying to Monitor.

Can anyone suggest what could be the real cause for this issue.

Below is the inputs.conf configuration

[monitor:///usr2/oracle/saltlog/*logs.log]
sourcetype = oracle_os:healthcheck
index = os_na
interval = 600
crcSalt = <SOURCE>

Below is the props.conf configuration

[sourcetype:oracle_os:healthcheck]
SHOULD_LINEMERGE= true
NO_BINARY_CHECK = true
BREAK_ONLY_AFTER = TIMESTAMP=
TRUNCATE =9999
TZ = US/Eastern
0 Karma
1 Solution

twh1
Communicator

Thanks @harsmarvania57 . I moved props.conf on indexer but after that also I was getting same error. There was an issue with folder permission. Splunk user had read permission for file but not for the folder. So I was getting permission denied error.

View solution in original post

0 Karma

twh1
Communicator

Thanks @harsmarvania57 . I moved props.conf on indexer but after that also I was getting same error. There was an issue with folder permission. Splunk user had read permission for file but not for the folder. So I was getting permission denied error.

0 Karma

harsmarvania57
Ultra Champion

Hi @twh1,

Login to the server on which logfile exists and try to read that log files using cat command with same user as splunk service is running and check whether there is any file permission issue is there or not.

Additionally props.conf which you have provided should be on Indexer OR Heavy Forwarder whichever comes first from Universal Forwarder.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...