topic Re: Why am I not getting logs from one source? in Splunk Enterprise

Why am I not getting logs from one source?

Ash1 — Thu, 30 Mar 2023 18:51:46 GMT

Hi all,

I have 2 servers and each having 3 sources.

I am able to receive logs from 2 sources from 2 servers but not receiving logs from one source

I checked there are logs on the server and no permission issues

How to troubleshoot???

Re: Why am I not getting logs from one source?

richgalloway — Thu, 30 Mar 2023 19:15:22 GMT

Verify the inputs are not disabled.

Use the splunk list monitor command to make sure the expected files are being monitored.

Check splunkd.log for messages relating to the files.

Re: Why am I not getting logs from one source?

Ash1 — Thu, 30 Mar 2023 22:49:16 GMT

i checked disabled is 0
Use the splunk list monitor command --> for this i dont have access to universal forwarder to check
i mentioned the source which was not coming in the search with index=_internal source=splunkd but i don't see any logs.

Re: Why am I not getting logs from one source?

isoutamo — Fri, 31 Mar 2023 10:07:05 GMT

here is one old answer (you could found lot of those) https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-a-universal-forwarder-lost-data-when/m-p/202949 to solve this kind of issues.

r. Ismo

Re: Why am I not getting logs from one source?

Ash1 — Wed, 12 Apr 2023 21:10:07 GMT

hi @isoutamo & @richgalloway , thank you for your inputs.
Actually the source was not added in inputs, i noticed it lately and added it, now i can see the logs.