Getting Data In

Why isn't my Universal Forwarder data making it into the Indexer?

fisk12
Path Finder

I have tried to set up a universialforwarder (first time from cli) and have it monitor some log files (/var/log/dhcpd.log for example)
The packets is being send and recived (checked with tcpdump on both end) but the host in not showing up in the splunk server. What kind of stuff should i start to check on the forwarder/server?

0 Karma

RubenOlsen
Path Finder

At a customer site I'm serving, 9 out of 10 problems with "missing data" is a mismatch between what is stated in the inputs.conf on the UF side and what is configured on the indexer side (i.e. the index you have in inputs.conf stanzas must also be present (and correctly configured) on the indexer side).

A quick way to determine if data is entering your indexes, is to check Manager -> Indexes. Locate your index and check the Earliest / Latest Event columns.

Depending on how your access controls with regards to accessing your indexes are configures, you might need to specify index= in the search field.

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

I would suggest that you look in splunkd.log under the $SPLUNK_HOME/var/log/splunk/ for messages that contain the ip address of the forwarder/indexer, depending on which place you are looking. That should give you some indication as to what is happening with your connection, and if it is successful.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...