I configured inputs.conf,my data can't indexed,but on UI i can add the data.
/opt/splunk/etc/apps/$APP/local
indexes.conf [_cpu] coldPath = $SPLUNK_DB/_cpu/colddb homePath = $SPLUNK_DB/_cpu/db thawedPath = $SPLUNK_DB/_cpu/thaweddb
inputs.conf [monitor:///root/date/CPU_.dat] disabled = false followTail = 0 host = host_regex = (?i).?(?P<hostname>d+.d+.d+.d+)_ index = _cpu sourcetype = cpuinfo
/opt/splunk/etc/system/local/ props.conf [cpuinfo] NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = false pulldown_type = 1
When i search "index=_cpu", event is 0.i don't know why? who can help me?