About jonahtang

KpiBuff · ‎02-05-2015

This may not be the answer, but it is helpful to know about the log files.

jonahtang · ‎10-15-2013

Is your input coming in from a universal forwarder? If I'm not wrong, you have to put the props.conf somewhere else (e.g. on the heavy forwarder or the indexer) for its rules to work since universal forwarders have limited props.conf capability. Another thing you can try is to specify the LINE_BREAKER in the props.conf

jonahtang · ‎07-09-2013

Found it: The state data is in $SPLUNK_HOME/var/lib/splunk/modinputs/hdfs . Deleting the file(s) in this seems to make splunk index everything again.

Posts	4
Solutions	1
Karma Given	3
Karma Received	2
Member Since	‎02-25-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Deployment Server not pushing apps to universal fo...

HadoopConnect: How do I reset the HDFS input?

Re: Deployment Server not pushing apps to universa...

Re: Script Input broken into events

Re: HadoopConnect: How do I reset the HDFS input?