Getting Data In

Why are DAT files not being read with my current monitor configurations?

RichaSingh
Path Finder

Hi,

I have configured an app being pushed from deployment server to a remote Windows host to read DAT files.

Links already referenced:
http://splunk-base.splunk.com/answers/60643/archiveprocessor-bypassing-normal-systemlocalpropsconf-p...
https://answers.splunk.com/answers/55279/handling-text-dat-files-how-can-i-override-splunks-system-d...

The configuration looks like this :
props.conf

 [source::....(dat)]
 sourcetype = mysourcetype

inputs.conf

[default]
index = app
sourcetype = mysourcetype
[monitor://D:\folder\folder\Server34\encyc\status\*\*]
[monitor://C:\Anupama\status\...\...]
[monitor://C:\folder\status\*\*]
[monitor://C:\folder\status\*.dat]

It is weird that all the files in the folder getting read, except for the required DAT files.

Can someone help with the best configurations, please ?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

I'd recommend reading here for best practices on monitor and wildcards :
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Specifyinputpathswithwildcards

Your monitors should look more like

[monitor://path*/*.dat]
sourcetype = mysourcetype

As for the source statement, this would re-sourcetype all dat files, however, Im not sure if your syntax is correct on this. Typically it should look more like

[source::.....dat]

Notice the 4 x "...." + ".dat". Your's doesnt have this, so Im not sure if its going to match correctly.

Out of curiosity, does your ".dat" contain ascii or binary data? Without pre-processing this into ascii / human readable format, it wont be worth indexing.

RichaSingh
Path Finder

esix [Splunk] ,

Thanks for your inputs here.

Yes, the DAT file contains ACII value in readable format.

thanks

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...