Splunk Enterprise

Why my inputs.conf does not work ?

mah
Builder

Hi,

I have a script on heavy forwarder which output a csv file in /bin 

I have an inputs.conf set like this : 

[script://./bin/my_script.py]
interval = * * * * *
index = test
sourcetype = test:st
disabled = 0

[monitor:///opt/splunk/etc/apps/my_app/bin/csv_file.csv]
index = test
sourcetype = test:st
disabled = 0
crcSalt = <SOURCE>

My props.conf :

SHOULD_LINEMERGE = false
FIELD_DELIMITER=,
HEADER_FIELD_LINE_NUMBER = 1
HEADER_FIELD_DELIMITER=,
INDEXED_EXTRACTIONS=csv

My issue is that my csv is not indexed on splunk.

In index=_internal I have this INFO message :

 12/30/20
3:35:14.261 PM  INFO TailingProcessor - Adding watch on path: /opt/splunk/etc/apps/my_app/bin/csv_file.csv.
host = heavy-forwarder index = _internal log_level = INFO source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
12/30/20
3:35:14.261 PM
12-30-2020 14:35:14.261 +0000 INFO TailingProcessor - Parsing configuration stanza: monitor:///opt/splunk/etc/apps/my_app/bin/csv_file.csv.

INFO ExecProcessor - setting reschedule_ms=59661, for command=python /opt/splunk/etc/apps/my_app/bin/my_script.py

No ERROR message at script level also...

What I did wrong ?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...