Monitoring Splunk

Data preview option is missing

Path Finder

My environment is Splunk version 7.01 on MacOS Sierra.

When I try to monitor a folder (during configuration Settings > Data Inputs > Files and Directories), it gives me an error :

alt text

I only start having this problem after upgrading my laptop to MacOS Sierra with APFS. I have also entered the following line into $SPLUNK_HOME/etc/splunk-launch.conf
Without the above entry, Splunk cannot start.

My question is how come Data preview is skipped? Any way to fix this problem?


0 Karma

Splunk Employee
Splunk Employee

Hi htidore!

Glad to see you using add data wizard. It is a very useful way to ensure you build your sourcetypes right!

As the warning explicitly advises, data preview is skipped for directories. It has been this way as long as I can remember. It is not an issue, it is expected behavior. It cannot traverse multiple directories/deal with multiple files at once. You can still build the input this way, just can't test your props.

If you are trying to use it to build props, the best way around it is to start the data wiz as if you are working with a single file in the dir, navigate to a single file, set up the props the way you want, then use the "copy to clipboard" option to save the props settings you need, then cancel out of the wizard.

You can then go back thru the wizard to enable the input if you need to, after you put your props in the correct app.

- MattyMo
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...