Getting Data In

Some files are not being indexed

cchange
Path Finder

Hi,

I configured inputs.conf to monitor a directory. All the files in the directory were not ingested to Splunk. Some XML files are being missed. I don't see any errors in the _internal logs. Can you please let me know if I'm missing any property in my configuration file?

my sample inputs.conf

index=test
sourcetype=test

0 Karma

cchange
Path Finder

I added crcSalt = and missing files were ingested successfully.

0 Karma

kannu
Communicator

check your splunkd log in splunkhome/var/log/splunk/
for example
if you are looking file abc.txt then
cat splunkd.log | grep -i "abc.txt"

you will get the error message if not you will see the following entry [addingwatcher] that means file has been watched you will soon see the file contents on your search head

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi cchange,
could you share your inputs.conf and the pathnames of your target files?
Bye.
Giuseppe

0 Karma

cchange
Path Finder

Hello.

It look like this.

monitor:\\directory
index=test
sourcetype=test1
disabled=0

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi cchange,
there are some errors, you should have esomething like this:

[monitor://C:\directory\myfile.txt]
index=test
sourcetype=test1
disabled=0

remember that the first two slashes are fixed, in unix you have another one slash, instead in Windows you have the full path (with drive) of the files to monitor; you can also use *.
For more information see http://docs.splunk.com/Documentation/Splunk/latest/Data/Getstartedwithgettingdatain .
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...