Splunk crashes after restart. If i rename the config files its starts without a problem.
Version is 5.01
My configs:
input.conf
[monitor:///mnt/netapp/vol0_filer0/etc/log]
disabled = false
followTail = 0
host_segment = 3
index = netapp
blacklist = (stats)|(/mlog/.last_rotate)|(/log/autosupport)
[monitor:///mnt/netapp/vol0_filer1/etc/log]
disabled = false
followTail = 0
host_segment = 3
index = netapp
blacklist = (stats)|(/mlog/.last_rotate)|(/log/autosupport)
[script://$SPLUNK_HOME/etc/apps/SplunkAppforNetApp/bin/SNap.py -h 01]
disabled = 0
interval = 500
sourcetype = netapp:internal
index = netapp
snap_hosts.csv
10.2.X.X, user_api, somepass
10.2.X.X, user_api, somepass
@piebob
Sure, i'd edit inputs.conf (just a typo 😉
The third stanza "script://$SPLUNK_HOME/etc/apps/SplunkAppforNetApp/bin/SNap.py -h 01" is not necessary unless you are intentionally wanting to gather multiple sets of stats from different filers. The scripted input in default/inputs.conf (looks similar minus the "-h 01" portion) is all that you need in most cases. At the very least, remove this last stanza and see how that goes.
Adding the H parameter (which we haven't documented yet) requires that you create additional csv files for telling it what you want counters to grab. If that file is missing, I suppose it could cause the python script to throw an exception. That shouldn't crash Splunk, though.
note that we converted your review to a question so that we can interact and points can be awarded, and so on. thanks!
what config files are you renaming?
the inputs.conf file should be called inputs.conf, not input.conf, is this the problem?