Getting Data In

Unable to find the source file

dhs_harry08
Path Finder

hi,

I have this source showing in the splunk source=/opt/splunk/var/spool/splunk/singlehost.sample.sav

But when I checked the server I am unable to find this particular file. How is this possible.

If I want to find the source in this case how can I do it. For example if the data is coming through a network port.

Regards,
Harish

Tags (3)
0 Karma
1 Solution

dhs_harry08
Path Finder

I found the solution at last. These events were generated by an app by splunk SA-Eventgen. We were using PCI compliance app and while installation it seems this app was configured by default. After disabling the app these sample logs disappeared.

I found the solution in the Splunk security app FAQs.
http://docs.splunk.com/Documentation/ES/2.4/User/FAQ#How_do_I_manually_enable_eventgen.3F

But the same is not included in PCI compliance app documentation. Hope splunk sees this and update the PCI compliance app documentation.

Regards,
Harish

View solution in original post

0 Karma

dhs_harry08
Path Finder

I found the solution at last. These events were generated by an app by splunk SA-Eventgen. We were using PCI compliance app and while installation it seems this app was configured by default. After disabling the app these sample logs disappeared.

I found the solution in the Splunk security app FAQs.
http://docs.splunk.com/Documentation/ES/2.4/User/FAQ#How_do_I_manually_enable_eventgen.3F

But the same is not included in PCI compliance app documentation. Hope splunk sees this and update the PCI compliance app documentation.

Regards,
Harish

0 Karma

dhs_harry08
Path Finder

Is it possible to stop the files (/opt/splunk/var/spool/splunk/singlehost.sample.sav) from getting indexed.

0 Karma

Ayn
Legend

The data source just says where Splunk got the data from at the time of indexing. It doesn't say anything about the current status of that source.

In your particular case, the source is a file in Splunk's spool directory - files that are put in this directory are immediately deleted after they've been indexed.

0 Karma

Ayn
Legend

Easiest thing would be to make whatever is putting the files there in the first place stop what it's doing.

0 Karma

dhs_harry08
Path Finder

Is it possible to stop the files (/opt/splunk/var/spool/splunk/singlehost.sample.sav) from getting indexed

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk Life | Splunk is Officially Part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint. Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...