topic Re: Unable to get data into Splunk Cloud in Getting Data In

Unable to get data into Splunk Cloud

z080236 — Thu, 02 Dec 2021 13:02:42 GMT

1. I have installed universal forwarder and have a Splunk cloud account.

2. On the laptop in universal forwarder, i downloaded the file and execute the command: /opt/splunkforwarder/bin/splunk install app /tmp/splunkclouduf.spl.

3. I restart the splunk process.

No data went in, may I know why?

Note: I am trying to forward the Windows event log which is the same host where i installed the Splunk universal forwarder

Re: Unable to get data into Splunk Cloud

richgalloway — Thu, 02 Dec 2021 13:21:37 GMT

Do you see the forwarder's internal logs in Splunk Cloud? If so, then either no inputs are enabled or Splunk is unable to read the input. Check the logs for details.

If you don't see the forwarder's internal logs in Splunk Cloud then there's a problem connecting. Check the UF's logs locally for details.

Re: Unable to get data into Splunk Cloud

z080236 — Thu, 02 Dec 2021 14:30:45 GMT

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2109/Admin/WindowsGDI#Step_3:_Configure_indexes_on_your_Splunk_Cloud_Platform_instance

Can't I skip step 4 & 5 and go straight towards install the Splunk universal forwarder?

In the splunk forwarder I see,

12-02-2021 22:26:21.612 +0800 INFO TailReader [13912 tailreader0] - Batch input finished reading file='C:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log'
12-02-2021 22:26:41.414 +0800 INFO AutoLoadBalancedConnectionStrategy [10792 TcpOutEloop] - Found currently active indexer. Connected to idx=54.83.75.76:9997, reuse=1.
12-02-2021 22:26:52.019 +0800 INFO TailReader [13912 tailreader0] - Batch input finished reading file='C:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log'
12-02-2021 22:27:11.318 +0800 INFO AutoLoadBalancedConnectionStrategy [10792 TcpOutEloop] - Found currently active indexer. Connected to idx=54.83.75.76:9997, reuse=1.
12-02-2021 22:27:22.282 +0800 INFO TailReader [13912 tailreader0] - Batch input finished reading file='C:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log'
12-02-2021 22:27:41.208 +0800 INFO AutoLoadBalancedConnectionStrategy [10792 TcpOutEloop] - Found currently active indexer. Connected to idx=54.83.75.76:9997, reuse=1.
12-02-2021 22:27:51.500 +0800 INFO TailReader [13912 tailreader0] - Batch input finished reading file='C:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log'
12-02-2021 22:28:11.073 +0800 INFO AutoLoadBalancedConnectionStrategy [10792 TcpOutEloop] - Found currently active indexer. Connected to idx=54.83.75.76:9997, reuse=1.
12-02-2021 22:28:21.782 +0800 INFO TailReader [13912 tailreader0] - Batch input finished reading file='C:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log'
12-02-2021 22:28:40.951 +0800 INFO AutoLoadBalancedConnectionStrategy [10792 TcpOutEloop] - Found currently active indexer. Connected to idx=54.83.75.76:9997, reuse=1.
12-02-2021 22:28:52.022 +0800 INFO TailReader [13912 tailreader0] - Batch input finished reading file='C:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log'
12-02-2021 22:29:10.804 +0800 INFO AutoLoadBalancedConnectionStrategy [10792 TcpOutEloop] - Found currently active indexer. Connected to idx=54.83.75.76:9997, reuse=1.
12-02-2021 22:29:22.164 +0800 INFO TailReader [13912 tailreader0] - Batch input finished reading file='C:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log'
12-02-2021 22:29:40.691 +0800 INFO AutoLoadBalancedConnectionStrategy [10792 TcpOutEloop] - Found currently active indexer. Connected to idx=54.83.75.76:9997, reuse=1.
12-02-2021 22:29:52.369 +0800 INFO TailReader [13912 tailreader0] - Batch input finished reading file='C:\Program Files\SplunkUniversalForwarder\var\spool\splunk\tracker.log'

Re: Unable to get data into Splunk Cloud

z080236 — Thu, 02 Dec 2021 14:41:27 GMT

From Splunk cloud:

To set up the Universal Forwarder:

Download the Splunk universal forwarder.
Splunk Downloads web page
Install the universal forwarder on one or more machines in your network.
Installation Instructions
Download your customized universal forwarder credentials package.
Download Universal Forwarder Credentials
Install the universal forwarder credentials package on each universal forwarder in your network.
Installation Instructions
Configure your universal forwarders to send data to the Splunk platform.
Configure data inputs

Re: Unable to get data into Splunk Cloud

isoutamo — Thu, 02 Dec 2021 14:40:07 GMT

What you have gotten on step 7? If connection works then there should be some events which has come from your window workstation.

If/when you are skipping step 4&5 then there haven' teen configured any real inputs to your windows infra unless you add those manually on your UF hosts.

r. Ismo

Re: Unable to get data into Splunk Cloud

z080236 — Thu, 02 Dec 2021 14:59:55 GMT

I added inputs.conf in

C:\Program Files\SplunkUniversalForwarder\etc\apps\100_prd-p-gvnkg_splunkcloud\local

[WinEventLog://Application]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
renderXml=true
index=winevent

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
renderXml=true
index=winevent

[WinEventLog://System]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
renderXml=true
index=winevent

I saw some application logs inside, but seems like they did not parse correctly. I go ahead and install the Windows add-on app on the Splunk cloud?

https://splunkbase.splunk.com/app/742/

Re: Unable to get data into Splunk Cloud

z080236 — Thu, 02 Dec 2021 15:06:14 GMT

In splunk cloud, I went to Apps -> Browse more apps

Enter windows

Installed Splunk Add-On for Microsoft Windows

After that, the data was parsed correctly, can mark this as solved.

Re: Unable to get data into Splunk Cloud

bharath-boppid — Wed, 06 Apr 2022 22:50:11 GMT

1. I have installed universal forwarder and have a Splunk cloud account.

2. Installed Splunk using this command /opt/splunkforwarder/bin/splunk install app /tmp/splunkclouduf.spl.

3. restarted to get changes into effect.

no logs in Splunk cloud

index= "*" found nothing

Re: Unable to get data into Splunk Cloud

richgalloway — Thu, 07 Apr 2022 00:16:23 GMT

This question already has a solution. Please post a new question with details about your problem.