Getting Data In

can't find data

ryanaa
Explorer

我現在遇到一個問題,我在SH放置好一個apps並連到uf上,在uf上也有監控到資料路徑,

但我在search時就沒有辦法找

以下是我的 inputs.conf:

 

 

[monitor:///tutorialdata/www*/access.log]
index = web
host_segment=2
sourcetype = web:access
[monitor:///tutorialdata/www*/secure.log]
index = web
host_segment=2
sourcetype = web:secure

 

以及props.conf

 

EVENT_BREAKER_ENABLE = true
EVENT_BREAKER = ([\r\n]+)
[web:secure]
EVENT_BREAKER_ENABLE = true
EVENT_BREAKER = ([\r\n]+)

 

 

 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Please make sure the inputs.conf file is installed on the UF.

Can you search for the UF's internal logs on the SH?  If not, then the UF is not properly connected to the SH/indexer.  Do you have a separate indexer?

Confirm the UF has read access to the files it is trying to monitor.

Please share the query you are using to search for the data on the SH.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please make sure the inputs.conf file is installed on the UF.

Can you search for the UF's internal logs on the SH?  If not, then the UF is not properly connected to the SH/indexer.  Do you have a separate indexer?

Confirm the UF has read access to the files it is trying to monitor.

Please share the query you are using to search for the data on the SH.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...