新的CSV文件未与索引Splunk同步

如何解决新的CSV文件未与索引Splunk同步

我遇到了Splunk的问题，例如存在一个索引，其中包含一些csv文件的文件夹作为数据输入。当我在该文件夹中为该索引添加另一个CSV文件时，新的源数据未显示在索引中。 我已经重启Splunk很多次了，删除索引并重新创建，但是问题仍然存在。

我没有为该文件夹添加任何配置。

如果需要，我是否需要为该文件夹添加任何配置文件，请帮我，我是splunk的新手。

还有一件事，如果我检查设置中的文件计数>文件夹的数据输入显示正确，但是当我使用映射索引搜索任何查询时，就会出现问题，并且显示的文件少于预期。

默认Inputs.conf文件为：

[default]
index = default
_rcvbuf = 1572864
host = $decideOnStartup

[blacklist:$SPLUNK_HOME/etc/auth]

[blacklist:$SPLUNK_HOME/etc/passwd]

[monitor://$SPLUNK_HOME/var/log/splunk]
index = _internal

[monitor://$SPLUNK_HOME/var/log/watchdog/watchdog.log*]
index = _internal

[monitor://$SPLUNK_HOME/var/log/splunk/license_usage_summary.log]
index = _telemetry

[monitor://$SPLUNK_HOME/var/log/splunk/splunk_instrumentation_cloud.log*]
index = _telemetry
sourcetype = splunk_cloud_telemetry

[monitor://$SPLUNK_HOME/etc/splunk.version]
_TCP_ROUTING = *
index = _internal
sourcetype=splunk_version

[batch://$SPLUNK_HOME/var/run/splunk/search_telemetry/*search_telemetry.json]
move_policy = sinkhole
index = _introspection
sourcetype = search_telemetry
crcSalt = <SOURCE>
log_on_completion = 0

[batch://$SPLUNK_HOME/var/spool/splunk]
move_policy = sinkhole
crcSalt = <SOURCE>

[batch://$SPLUNK_HOME/var/spool/splunk/...stash_new]
queue = stashparsing
sourcetype = stash_new
move_policy = sinkhole
crcSalt = <SOURCE>

[fschange:$SPLUNK_HOME/etc]
#poll every 10 minutes
pollPeriod = 600
#generate audit events into the audit index,instead of fschange events
signedaudit=true
recurse=true
followLinks=false
hashMaxSize=-1
fullEvent=false
sendEventMaxSize=-1
filesPerDelay = 10
delayInMills = 100

[udp]
connection_host=ip

[tcp]
acceptFrom=*
connection_host=dns

[splunktcp]
route=has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:indexQueue;absent_key:_linebreaker:pars$
acceptFrom=*
connection_host=ip

[script]
interval = 60.0
start_by_shell = true

[SSL]
# SSL settings
# The following provides modern TLS configuration that guarantees forward-
# secrecy and efficiency. This configuration drops support for old Splunk
# versions (Splunk 5.x and earlier).
# To add support for Splunk 5.x set sslVersions to tls and add this to the
# end of cipherSuite:
# DHE-RSA-AES256-SHA:AES256-SHA:DHE-RSA-AES128-SHA:AES128-SHA
# and this,in case Diffie Hellman is not configured:
# AES256-SHA:AES128-SHA

sslVersions = tls1.2
cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA$
ecdhCurves = prime256v1,secp384r1,secp521r1

allowSslRenegotiation = true
sslQuietShutdown = false

解决方法

您需要创建一个新的monitor节，该节指向您的CSV文件所在的位置。例如，

[monitior:///home/user/data/myfile.csv]
index= csv_data

在某些情况下（例如，单个Splunk实例），您可以通过Web GUI添加它，或者您可能需要修改文件。

请参阅https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/Monitorfilesanddirectorieswithinputs.conf和https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Inputsconf

最佳做法是不要修改默认的inputs.conf文件。相反，您应该在/opt/splunk/etc/system/local/inputs.conf创建一个文件，并在其中包含monitor节。