Getting Data In

I need documentation about how to index a directory all steps

tissparkle
Explorer

Hi, I hope somebody can help me.

thx

Tags (2)
0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

Did you look at the "Getting Data In" documentation?

This is documented in great detail in that manual. You can use the web interface if there directory is on your indexer, you can use the client interface, or you can edit a configuration file.

To use the client interface you would run the add monitor command:
$SPLUNK_HOME/splunk add monitor /var/log/

http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorfilesanddirectoriesusingtheCLI

okrabbe_splunk
Splunk Employee
Splunk Employee

can you paste the exact monitor stanza you are using and exactly where you put inputs.conf? Sometimes very slight changes can make it not work correctly.

0 Karma

tissparkle
Explorer

I had put the csv file in a directory,when I choose the index for indexing I choose "main" but if I go to manager and index in the main there aren't any events,help to find out the reason why there aren't the events indexed.
the version is 5.0.2, in the input.conf:
[monitor:MyDir]
index=MyIndex
sourcetype=csv
where in "myDir" I wrote: c: ...
the index is : test1
I wrote in the sourcetype=csv
I saw in Manager the sofware created automatically the input data file, the path is correct and the files are 2, that's is correct.But If I check the number of events are 0.

0 Karma

sunrise
Contributor

Maybe using splunk web is the most easiest way.
Use Splunk Web http://docs.splunk.com/Documentation/Splunk/latest/Data/UseSplunkWeb

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...