topic Re: Universal Forwarder in Getting Data In

Data is not being registered by Universal Forwarder- Which part should I check?

hhhwang — Tue, 13 Sep 2022 12:55:00 GMT

Data cannot be registered by Universal Forwarder.

There are a total of 12 Universal Forwarders.

Only one of these universal forwarders registers data.

Even if I change crcSalt, the data cannot be registered.

Which part should I check?

[monitor://D:\Splunk\iocheck\PMC*\PMC*.csv]
disabled = 0
index = pmc
host_segment = 3
sourcetype = pmc_iotable
crcSalt = <SOURCE>

Re: Universal Forwarder

scelikok — Tue, 13 Sep 2022 04:10:33 GMT

Hi @hhhwang,

Your input is disabled. And also please check if "iocheck" is the hostname of that sample UF. If not you should change host_segment with the correct segment. Please test below;

[monitor://D:\Splunk\iocheck\PMC*\PMC*.csv] disabled = 0 index = pmc host_segment = 3 sourcetype = pmc_iotable crcSalt = <SOURCE>

Re: Universal Forwarder

hhhwang — Tue, 13 Sep 2022 04:40:46 GMT

Hi, @scelikok,

disabled = 0 is enabled, disabled = 1 is disabled, isn't it?

And the host name is different from the name of UF.

Splunk is installed and used on a per-device basis, and this issue occurs occasionally. In other cases, the data is collected well.

Re: Universal Forwarder

scelikok — Tue, 13 Sep 2022 05:01:14 GMT

Hi @hhhwang,

Yes, disabled = 0 means enabled. It is not possible to collect data with disabled = 1.

Also if the file path you monitor does not have a hostname you can delete the host_segment setting. It will capture the correct hostname of UF.

Maybe because of the wrong host value, your events are going to Splunk as if they are on the same host.

Please try deleting the host_segment line.

I don't have any other reason for the occasional problem.