Splunk Enterprise

Splunk cannot index $SPLUNK_HOME/var/log

daniel_splunk
Splunk Employee
Splunk Employee

When I search index=_internal, log from $SPLUNK_HOME/var/log cannot be indexed. I check splunkd.log and found out the inputs.conf is disabled.

Any idea what casuse this.

01-27-2015 14:38:11.494 +1030 INFO  TailingProcessor - TailWatcher initializing...
01-27-2015 14:38:11.494 +1030 INFO  TailingProcessor - Input module disabled in inputs.conf, will not load.
Tags (1)
0 Karma
1 Solution

daniel_splunk
Splunk Employee
Splunk Employee

One possible reason is the default stanza is disabled.

Run below command to verify.

./splunk cmd btool --debug inputs list default

If the return got a line saying 'disabled = 1', that is the culript.

View solution in original post

0 Karma

daniel_splunk
Splunk Employee
Splunk Employee

One possible reason is the default stanza is disabled.

Run below command to verify.

./splunk cmd btool --debug inputs list default

If the return got a line saying 'disabled = 1', that is the culript.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...