topic Re: Cannot see logs on servers in Splunk Enterprise

Why can't I see logs on servers?

mahesh27 — Fri, 17 Mar 2023 18:35:28 GMT

Hi All,

I have one universal forwarder which is reporting to DS and receiving internal logs, but i am not getting any data into index.
Logs are present in the server.

How to troubleshoot this kind of issues???

Re: Cannot see logs on servers

somesoni2 — Thu, 16 Mar 2023 20:53:49 GMT

Here are the few things you can check:

Check if UF is throwing any permission issues while reading the log files (index=_internal host=UF sourcetype=splunkd permission denied. OR similar search). If you've backend access to the forwarder, you can check the permissions on the file to ensure that splunk user (or user with which Splunk forwarder is running) can access the files.
Run btool on UF to ensure correct inputs.conf is present ($SPLUNK_HOME/bin/splunk btool inputs list --debug | grep -v system/default)
Run Splunk CLI command to check currently monitored files. ($SPLUNK_HOME/bin/splunk list monitor)

Re: Cannot see logs on servers

PickleRick — Thu, 16 Mar 2023 22:28:52 GMT

From what you're saying I understand that your UF manages to register itself with the DS so you can see it in the DS console. But do you have any outputs defined on this UF? Either locally or by means of app deployed from DS...