问题描述
我遇到了Splunk的问题,例如存在一个索引,其中包含一些csv文件的文件夹作为数据输入。当我在该文件夹中为该索引添加另一个CSV文件时,新的源数据未显示在索引中。 我已经重启Splunk很多次了,删除索引并重新创建,但是问题仍然存在。
我没有为该文件夹添加任何配置。
如果需要,我是否需要为该文件夹添加任何配置文件,请帮我,我是splunk的新手。
还有一件事,如果我检查设置中的文件计数>文件夹的数据输入显示正确,但是当我使用映射索引搜索任何查询时,就会出现问题,并且显示的文件少于预期。
默认Inputs.conf文件为:
[default]
index = default
_rcvbuf = 1572864
host = $decideOnStartup
[blacklist:$SPLUNK_HOME/etc/auth]
[blacklist:$SPLUNK_HOME/etc/passwd]
[monitor://$SPLUNK_HOME/var/log/splunk]
index = _internal
[monitor://$SPLUNK_HOME/var/log/watchdog/watchdog.log*]
index = _internal
[monitor://$SPLUNK_HOME/var/log/splunk/license_usage_summary.log]
index = _telemetry
[monitor://$SPLUNK_HOME/var/log/splunk/splunk_instrumentation_cloud.log*]
index = _telemetry
sourcetype = splunk_cloud_telemetry
[monitor://$SPLUNK_HOME/etc/splunk.version]
_TCP_ROUTING = *
index = _internal
sourcetype=splunk_version
[batch://$SPLUNK_HOME/var/run/splunk/search_telemetry/*search_telemetry.json]
move_policy = sinkhole
index = _introspection
sourcetype = search_telemetry
crcSalt = <SOURCE>
log_on_completion = 0
[batch://$SPLUNK_HOME/var/spool/splunk]
move_policy = sinkhole
crcSalt = <SOURCE>
[batch://$SPLUNK_HOME/var/spool/splunk/...stash_new]
queue = stashparsing
sourcetype = stash_new
move_policy = sinkhole
crcSalt = <SOURCE>
[fschange:$SPLUNK_HOME/etc]
#poll every 10 minutes
pollPeriod = 600
#generate audit events into the audit index,instead of fschange events
signedaudit=true
recurse=true
followLinks=false
hashMaxSize=-1
fullEvent=false
sendEventMaxSize=-1
filesPerDelay = 10
delayInMills = 100
[udp]
connection_host=ip
[tcp]
acceptFrom=*
connection_host=dns
[splunktcp]
route=has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:indexQueue;absent_key:_linebreaker:pars$
acceptFrom=*
connection_host=ip
[script]
interval = 60.0
start_by_shell = true
[SSL]
# SSL settings
# The following provides modern TLS configuration that guarantees forward-
# secrecy and efficiency. This configuration drops support for old Splunk
# versions (Splunk 5.x and earlier).
# To add support for Splunk 5.x set sslVersions to tls and add this to the
# end of cipherSuite:
# DHE-RSA-AES256-SHA:AES256-SHA:DHE-RSA-AES128-SHA:AES128-SHA
# and this,in case Diffie Hellman is not configured:
# AES256-SHA:AES128-SHA
sslVersions = tls1.2
cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA$
ecdhCurves = prime256v1,secp384r1,secp521r1
allowSslRenegotiation = true
sslQuietShutdown = false
解决方法
您需要创建一个新的monitor
节,该节指向您的CSV文件所在的位置。例如,
[monitior:///home/user/data/myfile.csv]
index= csv_data
在某些情况下(例如,单个Splunk实例),您可以通过Web GUI添加它,或者您可能需要修改文件。
请参阅https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/Monitorfilesanddirectorieswithinputs.conf和https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Inputsconf
最佳做法是不要修改默认的inputs.conf
文件。相反,您应该在/opt/splunk/etc/system/local/inputs.conf
创建一个文件,并在其中包含monitor
节。