Monitoring Splunk

_internal Index not indexing application log

robettinger
Explorer

Hi,

we created an app which writes its log into $SPLUNK_HOME/var/log/splunk

Event though the folder is being monitored with no blacklisted files, the application log is not being indexed. There is no mention to send_to_null_queue for this particular file so I am a bit confused.

You guys have any idea?

Thanks,
Robert

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @robettinger

This should work fine. I have my own log for my personal custom app and it writes to /opt/splunk/var/log/splunk/my_app.log and it is being read into _internal just fine - no additional inputs.conf stanzas required.

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...