Why does Splunk UF stop sending data a few minutes after the start?

jg91 — Tue, 20 Sep 2022 14:39:06 GMT

Hi, in a Linux server, a UF is configured to monitor a log directory, and it stops sending data to the indexer after about 2 minutes. When I restart the UF from the deployment server, it will start sending data and then stop sending.
Other inputs configuration like running scripts are working fine, and there is no error or warning in the _internal index about this host.
Do you have any idea about this problem?

Re: Why does Splunk UF stop sending data a few minutes after the start?

isoutamo — Tue, 04 Oct 2022 11:19:33 GMT

Can you share some more information about this:

It succeed to send events like 2min then it stops? This happen every time when you are restarting it?
Linux version / os
Splunk UF versio + indexer version (is there HF between UF and IDX)?
Is DS in use or how those UFs' are configured
Your inputs.conf
Check with btool that this is correct and no additions to another TA/apps
Are another inputs working (file/directory based)?
Has this ever working?
In which user splunkd is running and who own those log files?

r. Ismo

topic Why does Splunk UF stop sending data a few minutes after the start? in Getting Data In

Why does Splunk UF stop sending data a few minutes after the start?

Re: Why does Splunk UF stop sending data a few minutes after the start?