We have moved some of our jobs over to a NetApp configuration on a brand new server, but I cannot get the data forwarded to my Splunk indexer. I installed the forwarder and verified that I can successfully telnet from the host to my indexer and port. The machine I used to install the forwarder is able to connect to the NetApp as well.
inputs.conf configuration:
[monitor://\\netapp\BOOMI\prod\BoomiAtomsphere\logs\*.log]
disabled = false
index = boomi_prod
host = boomi-netapp
crcSalt =
Perhaps I am using the crcSalt incorrectly?
Any help is greatly appreciated!
Is your outputs.conf
pointing to the indexer?
Yes it's pointing to the correct indexer and port.
I would try putting a temp folder directly in your /opt
directory and put a few tmp files as a test to see if you can get it working.. I'd also recommend using the base minimum in your inputs.conf
.. Is your server.conf
stanza correct?
And lastly, I have to ask.. Is Splunk currently running?
[monitor://\\netapp\BOOMI\prod\BoomiAtomsphere\logs\*.log]
disabled = false
index = boomi_prod