Getting Data In

Why is my Splunk forwarder not sending data for all logs to indexer?

baujla
New Member

I have a forwarder installed on Linux server and 3 logfiles are configured to send data.

But only one or two logs are sending the data to index. If I disable the one log so that no data goes to that log, then the other two logs work and sends data. When all three are enabled, then one or two logs stop sending data to index.

How many logs can be configured in the forwarder's inputs.conf file? There is about 30 KB data coming per minute from each of these logs.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Yeah remove host name from each of your input stanzas and then add ignoreOlderThan=7d to each inputs stanza and see if that works.

0 Karma

andrei1bc
Communicator

From what i can see you are placing the inputs under the default folder. It is recommended to make use of the local folder.

Place under inputs.conf that is under : ../splunk/etc/apps/search/local

The hostname will be picked up from the default inputs.conf and it is not needed a 2nd time under the local inputs.conf

 [monitor:///MClogs/MC2016MC2Domain1_SP4/*.log]
 disabled = 0
 sourcetype = MC2016MC2_Domain1_Logs
 index = gptr_Blade

 [monitor:///MClogs/MC2016MC2Domain2_SP4/*.log]
 disabled = 0
 sourcetype = MC2016MC2_Domain2_Logs
 index = gptr_Blade

 [monitor:///MClogs/MC2016MC2Domain3_SP4/*.log]
 disabled = 0
 sourcetype = MC2016MC2_Domain3_Logs
 index = gptr_Blade
0 Karma

baujla
New Member

Hi, Here is my inputs.conf file:

[default]
host = Hosta

[monitor:///MClogs/MC2016MC2Domain1_SP4/*.log]
hostname = Hosta
disabled                = false
sourcetype              = MC2016MC2_Domain1_Logs
index                   = gptr_Blade

[monitor:///MClogs/MC2016MC2Domain2_SP4/*.log]
hostname = Hosta
disabled                = false
sourcetype              = MC2016MC2_Domain2_Logs
index                   = gptr_Blade

[monitor:///MClogs/MC2016MC2Domain3_SP4/*.log]
hostname = Hosta
disabled                = false
sourcetype              = MC2016MC2_Domain3_Logs
index                   = gptr_Blade

The three log files are MC2016MC2Domain1_SP4.log, MC2016MC2Domain2_SP4.log and MC2016MC2Domain3_SP4.log. One in each of the respective paths defined above.

Yes, I am using single indexer with single host trying to forward 3 source using 1 forwarder. Please let me know if you need more info.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Can you show us your inputs.conf file?

Can you also provide us the 3 path's and log names?

I'm assuming you're running a single indexer with a single host trying to forward 3 sources using 1 forwarder?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...