Getting Data In

splunk uf not reading logs

Path Finder

hellowe’ve directory structure as follows
/apps/ftp/user/logs/admin -- main directory
2018 2019 2020
and further more each sub-directory with year has directories with months as
01 02 02 03 04 05 06 07 08 09 10
under months directories we have csv log filesso to access a csv file for today
/apps/ftp/user/logs/admin/2020/10/20201008.csvhere is monitor stanza for to read this file
disabled = false
sourcetype = csv
index= user-access-logs
crcSalt = <SOURCE>but it’s not reading logs and no error in splunkd logs. can someone help me in correcting the monitor stanza if i’ve done mistake

Labels (3)
0 Karma

Can you try to replace .../... with ... as ... means any number of subdirectories. Other option is replace it with */*
r. Ismo
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!