Getting Data In

Why does Splunk forwarder not report on any default monitored directories?

bbiandov
Path Finder

I noticed that a new install of splunkforwarder automatically monitors the following directories:

Monitored Directories:
            $SPLUNK_HOME/var/log/splunk/splunkd.log
                    /opt/splunkforwarder/var/log/splunk/audit.log
                    /opt/splunkforwarder/var/log/splunk/btool.log
                    /opt/splunkforwarder/var/log/splunk/first_install.log
                    /opt/splunkforwarder/var/log/splunk/license_audit.log
                    /opt/splunkforwarder/var/log/splunk/license_usage.log
                    /opt/splunkforwarder/var/log/splunk/metrics.log
                    /opt/splunkforwarder/var/log/splunk/remote_searches.log
                    /opt/splunkforwarder/var/log/splunk/scheduler.log
                    /opt/splunkforwarder/var/log/splunk/searchhistory.log
                    /opt/splunkforwarder/var/log/splunk/splunkd-utility.log
                    /opt/splunkforwarder/var/log/splunk/splunkd.log
                    /opt/splunkforwarder/var/log/splunk/splunkd_access.log
                    /opt/splunkforwarder/var/log/splunk/splunkd_stderr.log
                    /opt/splunkforwarder/var/log/splunk/splunkd_stdout.log
            $SPLUNK_HOME/var/spool/splunk/...stash_new
    Monitored Files:
            $SPLUNK_HOME/etc/splunk.version

However it does NOT report on any of them; meaning, unless one manually addresses yet another directory, only the host shows up as reporting anything.

If one doesn't add any directories to be monitored at all then the newly installed forwarder does NOT report anything at all.
Is that normal behavior? Why wouldn't it report on the directories added by default shown above?

yannK
Splunk Employee
Splunk Employee

internal events are in the _internal index that is no searched by default.

As admin, try index=_internal

0 Karma

jrodman
Splunk Employee
Splunk Employee

What do you mean by report?

What are you doing in splunk? What happens? What are you expecting to happen that is different?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...