Splunk Enterprise

Splunk cannot index $SPLUNK_HOME/var/log

daniel_splunk
Splunk Employee
Splunk Employee

When I search index=_internal, log from $SPLUNK_HOME/var/log cannot be indexed. I check splunkd.log and found out the inputs.conf is disabled.

Any idea what casuse this.

01-27-2015 14:38:11.494 +1030 INFO  TailingProcessor - TailWatcher initializing...
01-27-2015 14:38:11.494 +1030 INFO  TailingProcessor - Input module disabled in inputs.conf, will not load.
Tags (1)
0 Karma
1 Solution

daniel_splunk
Splunk Employee
Splunk Employee

One possible reason is the default stanza is disabled.

Run below command to verify.

./splunk cmd btool --debug inputs list default

If the return got a line saying 'disabled = 1', that is the culript.

View solution in original post

0 Karma

daniel_splunk
Splunk Employee
Splunk Employee

One possible reason is the default stanza is disabled.

Run below command to verify.

./splunk cmd btool --debug inputs list default

If the return got a line saying 'disabled = 1', that is the culript.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...