Hi,
I configured inputs.conf to monitor a directory. All the files in the directory were not ingested to Splunk. Some XML files are being missed. I don't see any errors in the _internal logs. Can you please let me know if I'm missing any property in my configuration file?
my sample inputs.conf
index=test
sourcetype=test
I added crcSalt = and missing files were ingested successfully.
check your splunkd log in splunkhome/var/log/splunk/
for example
if you are looking file abc.txt then
cat splunkd.log | grep -i "abc.txt"
you will get the error message if not you will see the following entry [addingwatcher] that means file has been watched you will soon see the file contents on your search head
Hi cchange,
could you share your inputs.conf and the pathnames of your target files?
Bye.
Giuseppe
Hello.
It look like this.
monitor:\\directory
index=test
sourcetype=test1
disabled=0
Hi cchange,
there are some errors, you should have esomething like this:
[monitor://C:\directory\myfile.txt]
index=test
sourcetype=test1
disabled=0
remember that the first two slashes are fixed, in unix you have another one slash, instead in Windows you have the full path (with drive) of the files to monitor; you can also use *.
For more information see http://docs.splunk.com/Documentation/Splunk/latest/Data/Getstartedwithgettingdatain .
Bye.
Giuseppe