Why am I unable to read logfiles?

[twh1]

I am trying to read log files from a server. I have made all the configuration in Splunk but data is not coming in Splunk search. When I checked Splunk's internal log, I got a permission denied error for that server. I logged to the specific server and verified that all users have read permission to path I am trying to Monitor.

Can anyone suggest what could be the real cause for this issue.

Below is the inputs.conf configuration

[monitor:///usr2/oracle/saltlog/*logs.log]
sourcetype = oracle_os:healthcheck
index = os_na
interval = 600
crcSalt = <SOURCE>

Below is the props.conf configuration

[sourcetype:oracle_os:healthcheck]
SHOULD_LINEMERGE= true
NO_BINARY_CHECK = true
BREAK_ONLY_AFTER = TIMESTAMP=
TRUNCATE =9999
TZ = US/Eastern

[twh1 · Accepted solution]

Thanks @harsmarvania57 . I moved props.conf on indexer but after that also I was getting same error. There was an issue with folder permission. Splunk user had read permission for file but not for the folder. So I was getting permission denied error.

[harsmarvania57]

Hi @twh1,

Login to the server on which logfile exists and try to read that log files using cat command with same user as splunk service is running and check whether there is any file permission issue is there or not.

Additionally props.conf which you have provided should be on Indexer OR Heavy Forwarder whichever comes first from Universal Forwarder.