We have below monitor stanza in inputs.conf file
[monitor:///usr/sap/IXD/SYS/profile]
disabled = false
index = erp
crcSalt = SOURCE
This profile folder contains 3 important text files DEFAULT.PFL, IXD_DVEBMGS17_spwdfvml0248, START_DVEBMGS17_spwdfvml0248
which we want splunk to monitor. But its monitoring only DEFAULT.PFL file, when searched in indexer its not giving any results, Tried with all wild character search but no use.
Please advice how to solve this issue, this is very critical for us as these files are very important to be monitores in all our several servers.
What _d_ mentioned looks good and I would say that you might want to double check the path and permissions for the files to be monitored as well as the access rights for the Splunk user when running your search, including making sure that the Splunk user has access to the index you are sending these events to.
So using:
[monitor:///usr/sap/IXD/SYS/profile]
disabled = false
index = erp
crcSalt = <SOURCE>
Followed by making sure that when you search that you specify
search index="erp" *
Should be fine as long as all the requirements are met for monitoring all the files. One last thing to consider. Is there any sort of file lock that might be on those files that would prevent Splunk from opening them to index?
Are the file permissions correct?
Hi,
Can anyone please help to resolve this issue.
yes, file permissions are correct
Try the stanza below:
[monitor:///usr/sap/IXD/SYS/profile]
disabled = false
index = erp
crcSalt = <SOURCE>
Notice that when the literal string <SOURCE>
(including the angle brackets) is added, the full directory path to the source file is added to the CRC. This ensures that each file being monitored has a unique CRC.
Hope this helps.
> please upvote and accept answer if you find it useful - thanks!
Thanks for your update, but it is not working:(
Also in somefile.out file from other host I see below log
From above log it should not show this file when searched, but when I searched for this file it gives me results for this file and I can see the file has indexed, which should not have happened I guess..its very strange!
Please help to resolve the above 2 issues.
Thanks in advance!