Getting Data In

Why does Splunk forwarder not report on any default monitored directories?

Path Finder

I noticed that a new install of splunkforwarder automatically monitors the following directories:

Monitored Directories:
    Monitored Files:

However it does NOT report on any of them; meaning, unless one manually addresses yet another directory, only the host shows up as reporting anything.

If one doesn't add any directories to be monitored at all then the newly installed forwarder does NOT report anything at all.
Is that normal behavior? Why wouldn't it report on the directories added by default shown above?

Splunk Employee
Splunk Employee

internal events are in the _internal index that is no searched by default.

As admin, try index=_internal

0 Karma

Splunk Employee
Splunk Employee

What do you mean by report?

What are you doing in splunk? What happens? What are you expecting to happen that is different?

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...