Getting Data In

can't find data

ryanaa
Explorer

我現在遇到一個問題,我在SH放置好一個apps並連到uf上,在uf上也有監控到資料路徑,

但我在search時就沒有辦法找

以下是我的 inputs.conf:

 

 

[monitor:///tutorialdata/www*/access.log]
index = web
host_segment=2
sourcetype = web:access
[monitor:///tutorialdata/www*/secure.log]
index = web
host_segment=2
sourcetype = web:secure

 

以及props.conf

 

EVENT_BREAKER_ENABLE = true
EVENT_BREAKER = ([\r\n]+)
[web:secure]
EVENT_BREAKER_ENABLE = true
EVENT_BREAKER = ([\r\n]+)

 

 

 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Please make sure the inputs.conf file is installed on the UF.

Can you search for the UF's internal logs on the SH?  If not, then the UF is not properly connected to the SH/indexer.  Do you have a separate indexer?

Confirm the UF has read access to the files it is trying to monitor.

Please share the query you are using to search for the data on the SH.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please make sure the inputs.conf file is installed on the UF.

Can you search for the UF's internal logs on the SH?  If not, then the UF is not properly connected to the SH/indexer.  Do you have a separate indexer?

Confirm the UF has read access to the files it is trying to monitor.

Please share the query you are using to search for the data on the SH.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...

Building a Self-Service and Scalable Observability Practice

Thursday, November 14, 2024  |  11AM PT / 2PM ET Register Now Join us in this session and learn how Splunk ...