Splunk Search

Troubleshooting inputs.conf

Kyle_Brandt
Path Finder

In Windows I have the following in the Inputs.conf:

[monitor://C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\]
disabled = 0
whitelist = ERRORLOG.*
recursive = false

However the ERRORLOG file is not showing up in splunk. I have other data and files that I can get to go in there but not this. I see no errors in the splunkd.log. How do I troubleshoot this?

0 Karma
1 Solution

southeringtonp
Motivator

It looks like you're trying to monitor a directory, but not recurse into any of the files within it. Try splunk list monitor and see if your ERRORLOG file shows up.

You don't really need a whitelist here anyway - you can use wildcards in the monitor definition. You should be able to just use a wild card in the path:

[monitor://C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\ERRORLOG.*]
disabled = 0

View solution in original post

0 Karma

southeringtonp
Motivator

It looks like you're trying to monitor a directory, but not recurse into any of the files within it. Try splunk list monitor and see if your ERRORLOG file shows up.

You don't really need a whitelist here anyway - you can use wildcards in the monitor definition. You should be able to just use a wild card in the path:

[monitor://C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\ERRORLOG.*]
disabled = 0
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

you can force reload of monitors in inputs.conf without a restart with e.g., ./splunk _internal call /data/inputs/monitor/_reload -auth admin:changeme

Kyle_Brandt
Path Finder

Okay, figured out I have to restart the service. I was just missing a directory at the end.. but that command is still very helpful, thanks!

0 Karma

southeringtonp
Motivator

IIRC it depends on how you add the new monitor entry. If you add it via splunk add monitor or through the Manager you don't need to restart. If you edit inputs.conf directly, a restart will be needed.

0 Karma

Kyle_Brandt
Path Finder

For that command, do I need to keep restarting the service or does that just read the configuration file?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...