1

I have a distributed Splunk 6 environment with which I am working through the installation of a new Technology Add-on. On my forwarder I am trying to add a new Data Input... Settings > Data inputs > Files & directories > New then select my file and click Next... on the Set Sourcetype page the message "Cannot preview on this Splunk instance" appears.

I have numerous other Data Input set up in the same manner and even another file from the same directory as this file that is throwing the message. The directory is local to the Linux box the fowarder is on and I already verified permissions on the file.

Still completely wet behind the ears with Splunk and stuck troubleshooting this problem.

Your assistance is appreciated.

Thanks.

user1801810
  • 145
  • 6

1 Answers1

0

Your forwarder is under Linux as I understand, why don't you add lookup files using the CLI?

splunk add monitor

You can specify sourcetype and index, look at this reference: http://docs.splunk.com/Documentation/Splunk/6.2.5/Data/MonitorfilesanddirectoriesusingtheCLI

Are you using GUI on forwarders? Using universal forwarder or heavy forwarder?

Hope it works!!

NetZ
  • 36
  • 2