Deployment Architecture

Webintelligence: Data from specific server missing

Duke
Engager

Hi,

I got two VM, each of them running an apache webserver (A and B) and the splunk universal forwarder.
Both webservers produce combined-style logfiles (I made sure both are exactly the same) which the forwarder then tags explicitly as access_combined and sends to the index "webserver" on splunk master server.

I configured WI with "index=webserver sourcetype=access_c*", 127.0.0.1 as IP to exclude, "example.com" as excluded domain (I'd rather leave the field blank) and "/*.css" as excluded files.

So far so good. Now the problem:
Although the evententrys stored in the index are exactly the same (apart from obvious differences like host and source - since the logfiles are stored at different locations) only the logentrys from webserver B get processed by webintelligence, everything from A is ignored.

I tried using wi with only the logs of server A first and got stuck with the no data problem already discussed here (no data in the wi indexes what so ever). Now I'm surprised to see it working for server B.

I already checked the internal logs for errors, also completely reinstalled splunk and of course tried the common solutions of the no data problem.

What am I missing?
Thank for your help

Tags (2)
0 Karma
1 Solution

Duke
Engager

It appears I have to withdraw the question. During the wrinting of this question something magical seemed to have happend.
Maybe it was the browser cache (although I cleared that for testing alot) or something else got a lillte stuck but just like that it works.

View solution in original post

0 Karma

Duke
Engager

It appears I have to withdraw the question. During the wrinting of this question something magical seemed to have happend.
Maybe it was the browser cache (although I cleared that for testing alot) or something else got a lillte stuck but just like that it works.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...