Splunk Search

How to index data in new index?

geetanjali
Path Finder

Hello,

I have created new index "myIndex". I want to index my new data in this index. I have done changes in input.conf.

[monitor: / "path"]
disabled = false
host_segment=5
index = myIndex

and have put my log files in specific path. and have restarted splunk. Still then my data is not indexed. its showing "0 events". when i am search with "index=myIndex".

i have checked _internal also. it is not showing any error. But in INFO it is showing :

-0400 INFO  TailingProcessor - Parsing configuration stanza: monitor:/"path".

 * host=Splunck-118   Options| * sourcetype=splunkd   Options| * source="path"/log/splunk/splunkd.log

What i am missing in my process? Need help.

Thanks in advance

Tags (3)
0 Karma

Simeon
Splunk Employee
Splunk Employee

It is possible that your usage of path is not allowed.

Typically, it should look like:

[monitor://path/to/my/data]

Try using the splunk list monitor command to see if it picked up your file:

./splunk list monitor
Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...