About santhoshi

santhoshi · ‎08-02-2021

To answer the first question.. When installing Splunk the necessary file is placed in "C:\Program Files\Splunk\openssl.cnf". Installing Splunk does not set the %OPENSSL_CONF% system variable that points to the file. Use the following to see if the system variable is set: echo %OPENSSL_CONF% If the variable is not set you can tell Windows to use the configuration file provided by Splunk. set OPENSSL_CONF=c:\Program Files\Splunk\openssl.cnf

santhoshi · ‎02-15-2021

Hello, I am the facing the same issue. Logs are getting indexed only when I restart the forwarder, but do not index after that. I executed this command (splunk _internal call /services/admin/inputstatus/TailingProcessor:FileStatus) in Forwarder and found that I do not see the newer file stanzas at all. Also I do not see watched file line also for the newer files which are not getting indexed. There is no connectivity issue to DS and Indexer. I do not see any errors in splunkd.log. Can someone pls help to troubleshoot or suggest where the issue could be 😞

santhoshi · ‎09-28-2020

hello, thanks for your reply. Inputs would be like this. [monitor:///opt/nfmp/alarm_*.log] disabled = false sourcetype = alarm_log index = proj_app crcSalt = <SOURCE> blacklist = (\.(tar|gz|bz2|tar.gz|tgz|tbz|tbz2|zip|z)$)

santhoshi · ‎09-26-2020

I have a Prod Linux server where I have deployed Universal forwarder and monitoring few directories. Say like below. This is a new server and I am integrating for first time on say Sep 8th. $ ls -la rwxr-xr-x 5 yusufshakeel yusufshakeel 160 Sep 4 02:53 alarm_0409.log rwxr-xr-x 8 yusufshakeel yusufshakeel 256 Sep 5 02:53 alarm_0509.log rwxr-xr-x 2 yusufshakeel yusufshakeel 64 Sep 6 02:53 alarm_0609.log rwxr-xr-x 1 yusufshakeel yusufshakeel 10 Sep 7 02:53 alarm_0709.log rwxr-xr-x 2 yusufshakeel yusufshakeel 64 Sep 8 02:53 alarm_0809.log This is a new server and I am integrating for first time on say Sep 8th. Now the integration is completed and Splunk starts monitoring. I see only Sep 8th file got indexed and all the previous 4 logs (Sep 4 - Sep 7) didn't get ingested. My question is, will splunk not index older log files ;from the date it got integrated? Please help.

santhoshi · ‎09-09-2020

Hi Matthew, I am receiving the same errors as you, in splunkd.log of the UF. Things were working fine till today, but logs stopped getting indexed today after the IP of the server in which UF is installed got changed. Is your issue resolved? if so, could you please explain what changes you made which fixed the issue.

Posts	5
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎09-09-2020

Online Status	Offline
Date Last Visited	‎08-02-2021 12:51 PM

Will Splunk index old data present in a folder aft...

Re: Troubleshooting SSL Error on Forwarder

Re: "Files & Directories" Monitoring not reading a...

Re: Will Splunk index old data present in a folder...

Will Splunk index old data present in a folder aft...

Re: Splunk DC:DeploymentClient err=not_connected