Getting Data In

Why is my forwarder not forwarding data other than _internal?

sathiyasun
Explorer

I have forwarder not forwarding any input data other than _internal.

Checks performed:
splunk version - 6.4.2
Forwarder is up and running.
Checked the $SPLUNK_HOME/etc/system/local/inputs.conf . -- Checked the host name
Checked the $SPLUNK_HOME/etc/system/local/deploymentclient.conf
Checked the $SPLUNK_HOME/etc/system/local/server.conf
I don't see any error/warning in splunkd.log.
File path for the log files.

I have restarted the forwarder several times but no luck.
The inputs in the /etc/app are not forwarding.

Please advise.

0 Karma

pradeepkumarg
Influencer

Does the log files have data in them to forward?
Cross check the path for any type-o ?

0 Karma

sathiyasun
Explorer

Fixed, There was an mistake in the inputs whitelist. It works now. Thanks.

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...