_internal Index not indexing application log

[robettinger]

Hi,

we created an app which writes its log into $SPLUNK_HOME/var/log/splunk

Event though the folder is being monitored with no blacklisted files, the application log is not being indexed. There is no mention to send_to_null_queue for this particular file so I am a bit confused.

You guys have any idea?

Thanks,
Robert

[chrisyounger]

Hi @robettinger

This should work fine. I have my own log for my personal custom app and it writes to /opt/splunk/var/log/splunk/my_app.log and it is being read into _internal just fine - no additional inputs.conf stanzas required.