I am sending IIS logs to SplunkCloud. My inputs.conf looks like this:
[monitor://C:\inetpub\logs\LogFiles\W3SVC1]
ignoreOlderThan = 7d
sourcetype = web_log
initCrcLength = 400
[monitor://C:\inetpub\wwwroot\merge\requestlogs\...\*.csv]
ignoreOlderThan = 7d
sourcetype = csv_webrequest
crcSalt = <string>
recursive = true
initCrcLength = 400
It will work fine for a while, with SplunkCloud getting our data every second reliably as logs update.
The next day it will stop working, with log ingest slowing to a trickle: a few lines every few minutes. Restarting the forwarder occasionally works. Making a different change can work (changing the initCrcLength, adding or removing crcSalt, adding or removing alwaysOpenFile) but nothing works for more than a day or so.
Does anyone have any suggestions?
Thanks in advance.
What are the internal logs saying about the server that is sending logs to SplunkCloud? Any warnings or error messages that you can share for further help?
index=_internal host=<host_sending_logs> log_level IN ("ERROR", "WARN")
Hi
have you try this app https://splunkbase.splunk.com/app/3185 to collect those or are you using your own inputs.conf without any other definitions?
I propose to use that TA on all relevant places (see installation & configuration instructions).
r. Ismo
What are the internal logs saying about the server that is sending logs to SplunkCloud? Any warnings or error messages that you can share for further help?
index=_internal host=<host_sending_logs> log_level IN ("ERROR", "WARN")
This worked. Thanks!