Getting Data In

can't find data

ryanaa
Explorer

我現在遇到一個問題,我在SH放置好一個apps並連到uf上,在uf上也有監控到資料路徑,

但我在search時就沒有辦法找

以下是我的 inputs.conf:

 

 

[monitor:///tutorialdata/www*/access.log]
index = web
host_segment=2
sourcetype = web:access
[monitor:///tutorialdata/www*/secure.log]
index = web
host_segment=2
sourcetype = web:secure

 

以及props.conf

 

EVENT_BREAKER_ENABLE = true
EVENT_BREAKER = ([\r\n]+)
[web:secure]
EVENT_BREAKER_ENABLE = true
EVENT_BREAKER = ([\r\n]+)

 

 

 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Please make sure the inputs.conf file is installed on the UF.

Can you search for the UF's internal logs on the SH?  If not, then the UF is not properly connected to the SH/indexer.  Do you have a separate indexer?

Confirm the UF has read access to the files it is trying to monitor.

Please share the query you are using to search for the data on the SH.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please make sure the inputs.conf file is installed on the UF.

Can you search for the UF's internal logs on the SH?  If not, then the UF is not properly connected to the SH/indexer.  Do you have a separate indexer?

Confirm the UF has read access to the files it is trying to monitor.

Please share the query you are using to search for the data on the SH.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...