Getting Data In

Monitor in inputs.conf only indexes some files but not others with no discernible pattern

neiljpeterson
Communicator

I have a pretty standard monitor stanza defined on my web servers with the intention of indexing the config files

[monitor://D:\web\...\*]
disabled = false
index = web_apps
sourcetype = config
whitelist = \.config$

All the web roots are under web, and within those will be several config files at different levels. I am seeing some inconsistent behavior in the indexing. Some web.config files are indexed others are not. In the cases where the file is NOT indexed, other config files ARE indexed from the same dir at the same level.

Splunk UF is running as localsystem on Server 2008

All files have the same permissions and update times. They are part of a CI cycle, so are constantly updated throughout the day.

Tags (2)
0 Karma

kaufmanm
Communicator

Is it possible that ones that aren't getting indexed are identical to ones in other directories that are getting indexed? Splunk could see it as a duplicate file and skip indexing. Out of the box, Splunk isn't great at handling this sort of work.

You could try looking into adding crcSalt = <SOURCE> to your stanza, but it depends on your use cases.

0 Karma

neiljpeterson
Communicator

the file names are identical but the path and the contents are unique for each 😕

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...