topic Re: Issue with Universal Forwarder forwarding logs to index in Getting Data In

Why is there issue with Universal Forwarder forwarding logs to index?

Poojitha — Tue, 24 May 2022 15:20:58 GMT

Hi All,

I have installed splunk UF on windows . I have one static log file in system (json) and that need to be monitored. I have configure this in inputs.conf file.
I see only system/application and security logs being sent to indexer whereas the static log file is not seen.

I ran "splunk list inputstatus" and checked,

C:\Users\Administrator\Downloads\test\test.json file position = 75256 file size = 75256 percent = 100.00 type = finished reading

So, this means the file is being read properly.

What can be the issue that I dont see test.json logs at splunk side ? I tried checking index=_internal at indexer but not able to figure out what is causing issue, I checked few blogs on Internet as well. Can anyone please help on this.

Thanks in Advance,
Newbie to splunk

Re: Issue with Universal Forwarder forwarding logs to index

gcusello — Mon, 23 May 2022 09:53:30 GMT

Hi @Poojitha,

as you can read at https://docs.splunk.com/Documentation/Splunk/8.2.6/Data/Usingforwardingagents and in many other videos, you have to do some preventive actions:

did you already enable log receiving on Indexers [Settings -- Forwarderding and Receiving -- Receiving]?
did you already enable log forwarding on Universal Forwarder (outputs.conf or installation procedure)?
do you see internal logs from that Forwarders on Splunk (index=_internal host=<your_host>)

Ciao.

Giuseppe

Re: Issue with Universal Forwarder forwarding logs to index

Poojitha — Mon, 23 May 2022 14:44:25 GMT

@gcusello Thanks for your response

Yes, I have enabled it. I see system, application and security logs from that windows machine but not the log from the static file.
Yes , I have enabled
Yes, I checked index=_internal , there are logs from this host.

Searching the index=_internal and this host with the filename (test.json), I see nix_errors with tag=error :

active_searches=15, elapsedTime=0.604, search='pretypeahead prefix="index=_internal \"test_sourcetype\" \"test-host\" \"test.json max_time="1" count="50" use_cache=1', savedsearch_name="", drop_count=0, scan_count=0, eliminated_buckets=0, considered_events=0, decompressed_slices=0, events_count=0, total_slices=0, considered_buckets=0, search_rawdata_bucketcache_error=0, search_rawdata_bucketcache_miss=0, search_index_bucketcache_error=0, search_index_bucketcache_hit=0, search_index_bucketcache_miss=0, search_rawdata_bucketcache_hit=0, search_rawdata_bucketcache_miss_wait=0.000, search_index_bucketcache_miss_wait=0.000

What does this imply ?

Re: Issue with Universal Forwarder forwarding logs to index

gcusello — Mon, 23 May 2022 15:18:00 GMT

Hi @Poojitha,

the above tests were to understand if the connection id correctly establishhed.

Now, could you share your inputs.conf where the file is monitored?

in other words, a file called "inputs.conf" where is located a stanza with

[monitor://C:\Users\Administrator\Downloads\test\test.json]

Ciao.

Giuseppe

Re: Issue with Universal Forwarder forwarding logs to index

Poojitha — Mon, 23 May 2022 15:29:22 GMT

[WinEventLog://Application] disabled = 0 index = test_index sourcetype = test_sourcetype [WinEventLog://Security] disabled = 0 index = test_index sourcetype = test_sourcetype [WinEventLog://System] disabled = 0 index = test_index sourcetype = test_sourcetype [monitor://C:\Users\Administrator\Downloads\test\log.json] disabled = 0 index = test_index sourcetype = test_sourcetype

This is what my inputs.conf file

Re: Issue with Universal Forwarder forwarding logs to index

gcusello — Mon, 23 May 2022 15:42:43 GMT

Hi @Poojitha,

Splunk doesn't read twice a log, maybe your log was already read, could you try to add this row to ste stanza of your inputs.conf and restart Splunk on Forwarder?

crcSal = <SOURCE>

Ciao.

Giuseppe

Re: Issue with Universal Forwarder forwarding logs to index

Poojitha — Mon, 23 May 2022 16:58:08 GMT

This is how my inputs.conf file looks like

Re: Issue with Universal Forwarder forwarding logs to index

Poojitha — Mon, 23 May 2022 18:29:18 GMT

I tried this, its not working 😞

Re: Issue with Universal Forwarder forwarding logs to index

gcusello — Tue, 24 May 2022 06:26:51 GMT

Hi @Poojitha,

sorry: I missed a char!

crcSalt = <SOURCE>

Ciao.

Giuseppe