Using Splunk Enterprise trail license :
hi,
I have forwarded a file to indexer cluster by installing universal forwarder on host and deploying config files to UF using deployment server. but could find the data on cluster or search head, could someone help me to find out the issue from the below
Architecture Overview on GCP (Google Cloud Platform):
1 master node
1 search head
3 indexers
2 universal forwarders
1 deployment server
Server.conf on master node : path (opt/splunk/etc/system/local/
[clustering]
mode = master
replication_factor = 3
search_factor = 2
Deployment server configurations:
Created 2 apps under /opt/splunk/etc/deployment-apps/
UF_1
UF_2
configurations for app : UF_1
/opt/splunk/etc/deployment-apps/UF_1/default
Inputs.conf
[monitor://home/data/Phone_Numbers.csv]
disabled=false
outputs.conf
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
disabled = false
server = x.x.x.x:9997,y.y.y.y:9997,z.z.z.z:9997
serverclass.conf on deployment server : path /opt/splunk/etc/system/local/
[serverClass:class_1:app:UF_1]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
[serverClass:class_1]
whitelist.0 = universalforwarder
[serverClass:class_2:app:UF_2]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
[serverClass:class_2]
whitelist.0 = universalforwarder-2
1.Universal forwarder configurations
inputs.conf
[monitor://home/data/Phone_Numbers.csv]
disabled=false
outputs.conf
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
disabled = false
server = 103.104.86.126:9997,31.238.202.247:9997,31.202.197.21:9997
Verified on Indexer -1, couldn't find any file with timestamp created after data ingestion
/opt/splunk/var/lib/splunk/defaultdb/db
[root@indexer-1 db]# ls
CreationTime GlobalMetaData
verified on universal forwarder using command
./splunk list inputstatus
home/data/Phone_Numbers.csv
file position = 849
file size = 849
percent = 100.00
type = finished reading
... View more