Getting Data In

Need help troubleshooting oneshot

cgregors
Engager

I'm trying to get an archival datafile into the indexes via oneshot.

Current directory = C:\Program Files\SplunkUniversalForwarder\bin

Full path to source file = C:\Program Files\SplunkUniversalForwarder\bin\recovery\l21\20131213_153013\l21.almlog

Command = splunk add oneshot .\recovery\l21\20131213_153013\l21.almlog -sourcetype ld_alarm_log -index legacy-main -host ewwp0029

Output from command =

Oneshot 'C:\Program Files\SplunkUniversalForwarder\bin\recovery\l21\20131213_153
013\l21.almlog' added

Time passes and the data from the file doesn't appear in the indexes.

I'm looking for suggestions on troubleshooting the problem.

TIA

Chris

Tags (2)
0 Karma

cgregors
Engager

Found my own answer (always a good thing).

I was going to move the files off the windows box onto a linux box and oneshot them from there. It turns out all the logs are 0 bytes in length.

The app people have a bug in their script that doesn't archive the logs correctly. Nothing I can do about that except point it out for them.

Lesson learned: Start at the source and make sure there is data where you think there should be.
Thanks Chris.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...