Getting Data In

Unable to find the source file

dhs_harry08
Path Finder

hi,

I have this source showing in the splunk source=/opt/splunk/var/spool/splunk/singlehost.sample.sav

But when I checked the server I am unable to find this particular file. How is this possible.

If I want to find the source in this case how can I do it. For example if the data is coming through a network port.

Regards,
Harish

Tags (3)
0 Karma
1 Solution

dhs_harry08
Path Finder

I found the solution at last. These events were generated by an app by splunk SA-Eventgen. We were using PCI compliance app and while installation it seems this app was configured by default. After disabling the app these sample logs disappeared.

I found the solution in the Splunk security app FAQs.
http://docs.splunk.com/Documentation/ES/2.4/User/FAQ#How_do_I_manually_enable_eventgen.3F

But the same is not included in PCI compliance app documentation. Hope splunk sees this and update the PCI compliance app documentation.

Regards,
Harish

View solution in original post

0 Karma

dhs_harry08
Path Finder

I found the solution at last. These events were generated by an app by splunk SA-Eventgen. We were using PCI compliance app and while installation it seems this app was configured by default. After disabling the app these sample logs disappeared.

I found the solution in the Splunk security app FAQs.
http://docs.splunk.com/Documentation/ES/2.4/User/FAQ#How_do_I_manually_enable_eventgen.3F

But the same is not included in PCI compliance app documentation. Hope splunk sees this and update the PCI compliance app documentation.

Regards,
Harish

0 Karma

dhs_harry08
Path Finder

Is it possible to stop the files (/opt/splunk/var/spool/splunk/singlehost.sample.sav) from getting indexed.

0 Karma

Ayn
Legend

The data source just says where Splunk got the data from at the time of indexing. It doesn't say anything about the current status of that source.

In your particular case, the source is a file in Splunk's spool directory - files that are put in this directory are immediately deleted after they've been indexed.

0 Karma

Ayn
Legend

Easiest thing would be to make whatever is putting the files there in the first place stop what it's doing.

0 Karma

dhs_harry08
Path Finder

Is it possible to stop the files (/opt/splunk/var/spool/splunk/singlehost.sample.sav) from getting indexed

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...