Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Troubleshooting inputs.conf
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In Windows I have the following in the Inputs.conf:
[monitor://C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\]
disabled = 0
whitelist = ERRORLOG.*
recursive = false
However the ERRORLOG file is not showing up in splunk. I have other data and files that I can get to go in there but not this. I see no errors in the splunkd.log. How do I troubleshoot this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It looks like you're trying to monitor a directory, but not recurse into any of the files within it. Try splunk list monitor and see if your ERRORLOG file shows up.
You don't really need a whitelist here anyway - you can use wildcards in the monitor definition. You should be able to just use a wild card in the path:
[monitor://C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\ERRORLOG.*]
disabled = 0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It looks like you're trying to monitor a directory, but not recurse into any of the files within it. Try splunk list monitor and see if your ERRORLOG file shows up.
You don't really need a whitelist here anyway - you can use wildcards in the monitor definition. You should be able to just use a wild card in the path:
[monitor://C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\ERRORLOG.*]
disabled = 0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you can force reload of monitors in inputs.conf without a restart with e.g., ./splunk _internal call /data/inputs/monitor/_reload -auth admin:changeme
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Okay, figured out I have to restart the service. I was just missing a directory at the end.. but that command is still very helpful, thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
IIRC it depends on how you add the new monitor entry. If you add it via splunk add monitor or through the Manager you don't need to restart. If you edit inputs.conf directly, a restart will be needed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For that command, do I need to keep restarting the service or does that just read the configuration file?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions
Splunk Community Badges!
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
