×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
cmwhitmanjr
Loves-to-Learn
Member since: ‎12-30-2022
‎01-03-2023
Community Statistics
Posts 5
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎12-30-2022
Activity Feed
View All

Re: File Monitor Issue

by in Getting Data In
‎01-03-2023 05:14 AM
‎01-03-2023 05:14 AM
I tried this, no change.   ... View more

Re: File Monitor Issue

by in Getting Data In
‎01-02-2023 03:05 PM
‎01-02-2023 03:05 PM
Yes, I'm sure.  There are somewhere between 400-450 logs in that directory.  We have just over 300 being indexed properly.  They all ingest into the same index / sourcetype.     I've searched all indexes, I don't see this data popping up anywhere else.  It's just not there at all.   ... View more

Re: File Monitor Issue

by in Getting Data In
‎01-02-2023 08:17 AM
‎01-02-2023 08:17 AM
@gcusello Makes sense, as I mentioned in my reply to @PickleRick that line was added trying to solve a problem, but it made no difference in the files ingested anyway.   One question: why do you have three dots at the end of the monitor header?      I didn't set it up, I inherited administration after the fact.  I'm not sure why this choice was made over using the asterisk.  There aren't multiple levels of folders inside this directory, so it really doesn't make sense to use dots.  You think changing it will help the problem? ... View more

Re: File Monitor Issue

by in Getting Data In
‎01-02-2023 08:07 AM
‎01-02-2023 08:07 AM
I suppose I should have mentioned that prior to adding crcSalt=<source> I was using crcInitLength=1024 and we had the same issue.  I had hoped that by changing the value, it would resolve the issue, it has not.     splunk list inputstatus shows the files as monitored.  For example: /logs/reg1/last/1_CABLE_REEL_CABLE_REEL_2023-01-02.log file position = 710603 file size = 710603 parent = /logs/reg*/last/... percent = 100.00 type = open file The tstats search does not return the above source.   ... View more

When I search splunk, I'm missing all data from ab...

by in Getting Data In
‎12-30-2022 09:58 AM
‎12-30-2022 09:58 AM
I'm having an issue with one of my monitored paths.  Here's the monitor stanza, the blacklist line should only blacklist one file in a directory of about 420 log files: [monitor:///logs/reg*/last/...] sourcetype = xxxx:Regional blacklist = xxxx_\d{4}-\d{2}-\d{2}\.log index = xxxx disabled = false crcSalt = <SOURCE> The output of splunk list monitor shows me all the files I expect to see based on the above stanza.  Splunkd.log shows no problems reading any of them.  My problem is that when I search splunk, I'm missing all data from roughly 100 of the files, files that list monitor shows that I'm watching.   I recently added the crcSalt=<SOURCE> line thinking that would help, it has not.  Am I missing something obvious? ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎01-03-2023 04:11 PM