Splunk Apps » Syndication Input

Monitoring logs using:

index=_internal sourcetype="syndication_modular_input"

The latest_date is based on the latest entry.

https://answers.splunk.com/feed/questions.rss

Observations: *

Here is the search I have for listing the internal operation of the code:

index=_internal sourcetype="syndication_modular_input" | rex field=_raw "(?<action>((Skipping)|(Including)))"  | table date latest_date title action count

Some observations:

• I see the input indicating that items are included, but I don't see them

I'm seeing the following error:

Received event for unconfigured/disabled/deleted index=training with source="source::syndication://Splunk Answers" host="host::answers.splunk.com" sourcetype="sourcetype::SplunkTraining-Answers". So far received events from 1 missing index(es).

Fixed the index issue.

Now monitoring for changes via:

index=_internal sourcetype="syndication_modular_input"  | rex field=_raw "(?<action>((Skipping)|(Including)))" | search count>0 OR action=Including  | table date latest_date title action count

Table format of events:

sourcetype="syndication"  | eval time=strftime(_time, "%a, %d %b %Y %T %z") | table time title author link

Wondering if this is an issue where the connection fails and this isn't communicated well.