Monitoring Splunk

_internal Index not indexing application log

robettinger
Explorer

Hi,

we created an app which writes its log into $SPLUNK_HOME/var/log/splunk

Event though the folder is being monitored with no blacklisted files, the application log is not being indexed. There is no mention to send_to_null_queue for this particular file so I am a bit confused.

You guys have any idea?

Thanks,
Robert

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @robettinger

This should work fine. I have my own log for my personal custom app and it writes to /opt/splunk/var/log/splunk/my_app.log and it is being read into _internal just fine - no additional inputs.conf stanzas required.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!