Getting Data In

 


Improve the data input process

Troubleshoot the input process

NOTE - Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Troubleshoot the input process

Not finding the events you're looking for?

When you add an input to Splunk, that input gets added relative to the app you're in. Some apps, like the *nix and Windows apps, write input data to a specific index (in the case of *nix and Windows, that is the 'os' index). If you're not finding data that you're certain is in Splunk, be sure that you're looking at the right index. You may want to add the 'os' index to the list of default indexes for the role you're using. For more information about roles, refer to the topic about roles in the Admin manual.

Note: When you add inputs by editing inputs.conf, Splunk may not immediately recognize them. Splunk looks for inputs every 24 hours, starting from the time it was last restarted. This means that if you add a new stanza to monitor a directory or file, it could take up to 24 hours for Splunk to start indexing the contents of that directory or file. To ensure that your input is immediately recognized and indexed, add the input through Splunk Web or by using the add command in the CLI.

Troubleshoot your tailed files

You can use the FileStatus REST endpoint to get the status of your tailed files. For example:

https://serverhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus

Troubleshoot monitor inputs

For a variety of information on dealing with monitor input issues, see this article in the Community Wiki: Troubleshooting Monitor Inputs.

Can't find data coming from a forwarder?

Make sure the forwarder is functioning properly and is visible to the indexer. You can use the Deployment Monitor app to troubleshoot Splunk topologies and get to the root of any forwarder issues. See "About the deployment monitor" for details.

This documentation applies to the following versions of Splunk: 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 4.3.7 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!