Splunk cannot index $SPLUNK_HOME/var/log

[daniel_splunk]

When I search index=_internal, log from $SPLUNK_HOME/var/log cannot be indexed. I check splunkd.log and found out the inputs.conf is disabled.

Any idea what casuse this.

01-27-2015 14:38:11.494 +1030 INFO  TailingProcessor - TailWatcher initializing...
01-27-2015 14:38:11.494 +1030 INFO  TailingProcessor - Input module disabled in inputs.conf, will not load.

[daniel_splunk · Accepted solution]

One possible reason is the default stanza is disabled.

Run below command to verify.

./splunk cmd btool --debug inputs list default

If the return got a line saying 'disabled = 1', that is the culript.