Data preview option is missing

[htidore]

My environment is Splunk version 7.01 on MacOS Sierra.

When I try to monitor a folder (during configuration Settings > Data Inputs > Files and Directories), it gives me an error :

I only start having this problem after upgrading my laptop to MacOS Sierra with APFS. I have also entered the following line into $SPLUNK_HOME/etc/splunk-launch.conf
OPTIMISTIC_ABOUT_FILE_LOCKING = 1
Without the above entry, Splunk cannot start.

My question is how come Data preview is skipped? Any way to fix this problem?

Thanks.
Hanny.

[mattymo]

Hi htidore!

Glad to see you using add data wizard. It is a very useful way to ensure you build your sourcetypes right!

As the warning explicitly advises, data preview is skipped for directories. It has been this way as long as I can remember. It is not an issue, it is expected behavior. It cannot traverse multiple directories/deal with multiple files at once. You can still build the input this way, just can't test your props.

If you are trying to use it to build props, the best way around it is to start the data wiz as if you are working with a single file in the dir, navigate to a single file, set up the props the way you want, then use the "copy to clipboard" option to save the props settings you need, then cancel out of the wizard.

You can then go back thru the wizard to enable the input if you need to, after you put your props in the correct app.