When I search index=_internal, log from $SPLUNK_HOME/var/log cannot be indexed. I check splunkd.log and found out the inputs.conf is disabled.
Any idea what casuse this.
01-27-2015 14:38:11.494 +1030 INFO TailingProcessor - TailWatcher initializing...
01-27-2015 14:38:11.494 +1030 INFO TailingProcessor - Input module disabled in inputs.conf, will not load.
One possible reason is the default stanza is disabled.
Run below command to verify.
./splunk cmd btool --debug inputs list default
If the return got a line saying 'disabled = 1', that is the culript.
One possible reason is the default stanza is disabled.
Run below command to verify.
./splunk cmd btool --debug inputs list default
If the return got a line saying 'disabled = 1', that is the culript.