Getting Data In

Why does the Universal Forwarder not forward files to the index or sourcetype configured in inputs.conf?

yoyu777
Explorer

Hi,

I've spent one day trouble-shooting this issue but still don't have any luck.

The files I want to forward are a pretty standard .csv with custom timestamps. So I created a sourcetype and an index for them.

Then I added this stanza in "~/etc/system/local/inputs.conf", monitoring a directory:

[monitor:///splunk-files/data_live/]
disabled = false
index = main
sourcetype = serv_req_final

But I noticed that the files are not correctly forwarded to the correct index and not parsed to the correct sourcetype. Instead, they are indexed by the "main" index and the sourcetype is "csv".

I've tried to restart forwarder instance and the Splunk enterprise instance, cleaned event data several times. But nothing worked... Also I tried to remove the monitor stanza, and the monitor was gone (proving that there's no other conflicting input configurations).

Has anyone ran into similar issues?
It is really frustrating because what I am trying to do is what I consider really basic..

0 Karma
1 Solution

FritzWittwer_ol
Contributor

I'd try

$SPLUNK_HOME/bin/splunk btool --debug inputs list

it shows you what configuration the forwarder uses.

View solution in original post

FritzWittwer_ol
Contributor

I'd try

$SPLUNK_HOME/bin/splunk btool --debug inputs list

it shows you what configuration the forwarder uses.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...