Monitoring Splunk

Monitor file is not working on unix

722624
Path Finder
  1. I have splunk installed on *nix server
  2. created a folder 'splunk_monitor' in folder '/opt/splunk' ..given owner as same as splunk installed
  3. my inputs.conf file updated with below content
    [monitor:/$SPLUNK_HOME/splunk_monitor]
    index =
    sourcetype =

  4. this is not indexing any files, I cant see any events in search ..

  5. I tried searching with sourcetype, index, source etc...with many combinations.. still no result

  6. I tried checking few log files splunkd.log etc..

Please guide me how can I trouble shoot
Thank you

Amarander Busireddy

Tags (1)
0 Karma
1 Solution

hunters_splunk
Splunk Employee
Splunk Employee

Hi Amarander,

Please try adding a monitor input using CLI, for example:

./splunk add monitor /var/log/  -index newindex

For details, please refer to documentation: http://docs.splunk.com/Documentation/Splunk/6.5.1/Data/MonitorfilesanddirectoriesusingtheCLI

Hope this helps. Thanks!
Hunter

View solution in original post

0 Karma

ddrillic
Ultra Champion

We can start with I can't find my data!

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi Amarander,

Please try adding a monitor input using CLI, for example:

./splunk add monitor /var/log/  -index newindex

For details, please refer to documentation: http://docs.splunk.com/Documentation/Splunk/6.5.1/Data/MonitorfilesanddirectoriesusingtheCLI

Hope this helps. Thanks!
Hunter

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...