Monitoring Splunk

Data preview option is missing

htidore
Path Finder

My environment is Splunk version 7.01 on MacOS Sierra.

When I try to monitor a folder (during configuration Settings > Data Inputs > Files and Directories), it gives me an error :

alt text

I only start having this problem after upgrading my laptop to MacOS Sierra with APFS. I have also entered the following line into $SPLUNK_HOME/etc/splunk-launch.conf
OPTIMISTIC_ABOUT_FILE_LOCKING = 1
Without the above entry, Splunk cannot start.

My question is how come Data preview is skipped? Any way to fix this problem?

Thanks.
Hanny.

0 Karma

mattymo
Splunk Employee
Splunk Employee

Hi htidore!

Glad to see you using add data wizard. It is a very useful way to ensure you build your sourcetypes right!

As the warning explicitly advises, data preview is skipped for directories. It has been this way as long as I can remember. It is not an issue, it is expected behavior. It cannot traverse multiple directories/deal with multiple files at once. You can still build the input this way, just can't test your props.

If you are trying to use it to build props, the best way around it is to start the data wiz as if you are working with a single file in the dir, navigate to a single file, set up the props the way you want, then use the "copy to clipboard" option to save the props settings you need, then cancel out of the wizard.

You can then go back thru the wizard to enable the input if you need to, after you put your props in the correct app.

- MattyMo
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...