topic Re: Logs are not forwarding from the particular directory in Getting Data In

Logs are not forwarding from the particular directory?

yuvasree — Mon, 10 Oct 2022 07:14:01 GMT

I have forwarding the logs from the below directory. Below is the inputs.conf file

[monitor:///u01/app/oracle/scripts/SplunkMonitoring/Log]
disabled = false
index = osb
crcSalt = <SOURCE>

[monitor:///u01/app/oracle/scripts/Logging/output]
disabled = false
index = osb

=============

output from the /u01/app/oracle/scripts/Logging/output is forwarding successfully but no logs were received for /u01/app/oracle/scripts/SplunkMonitoring/Log. Below is the splunkd.log file.

10-09-2022 21:31:41.925 +0800 INFO WatchedFile [214996 tailreader0] - Will begin reading at offset=0 for file='/u01/app/oracle/scripts/SplunkMonitoring/Log/ServerStatus.txt'.
10-09-2022 21:32:01.208 +0800 INFO AutoLoadBalancedConnectionStrategy [214989 TcpOutEloop] - Connected to idx=10.9.0.49:9997:0, pset=0, reuse=0. autoBatch=1
10-09-2022 21:32:05.125 +0800 INFO TailReader [214996 tailreader0] - Batch input finished reading file='/opt/splunkforwarder/var/spool/splunk/tracker.log'
10-09-2022 21:32:31.053 +0800 INFO AutoLoadBalancedConnectionStrategy [214989 TcpOutEloop] - Connected to idx=10.9.0.49:9997:2, pset=0, reuse=0. autoBatch=1
10-09-2022 21:32:35.054 +0800 INFO TailReader [214996 tailreader0] - Batch input finished reading file='/opt/splunkforwarder/var/spool/splunk/tracker.log'
10-09-2022 21:33:00.976 +0800 INFO AutoLoadBalancedConnectionStrategy [214989 TcpOutEloop] - Connected to idx=10.9.0.49:9997:1, pset=0, reuse=0. autoBatch=1
10-09-2022 21:33:07.976 +0800 INFO TailReader [214996 tailreader0] - Batch input finished reading file='/opt/splunkforwarder/var/spool/splunk/tracker.log'
10-09-2022 21:33:21.924 +0800 INFO WatchedFile [214996 tailreader0] - Will begin reading at offset=0 for file='/u01/app/oracle/scripts/SplunkMonitoring/Log/jms_status.txt'.
10-09-2022 21:33:21.931 +0800 INFO WatchedFile [214996 tailreader0] - Will begin reading at offset=0 for file='/u01/app/oracle/scripts/SplunkMonitoring/Log/DataSourceStatus.txt'.

Re: Logs are not forwarding from the particular directory

gcusello — Sun, 09 Oct 2022 14:37:46 GMT

Hi @yuvasree,

did you defined the TIME_FORMAT in the props.conf?

see if your logs are present with the timestamp of the 10th of september

Ciao.

Giuseppe

Re: Logs are not forwarding from the particular directory

yuvasree — Sat, 15 Oct 2022 12:25:43 GMT

@gcusello Thanks for the reply.

I don't know how the issue resolved. but somehow it is forwarding from that server.

But again in one more server the file contents are not changed, hence splunk is ignoring the files under the folder. I need to forward it whenever the script output updated.

Below are the settings.

Props.conf

[brm_deployment_dev]
BREAK_ONLY_BEFORE_DATE =
DATETIME_CONFIG = CURRENT
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true
HEADER_FIELD_LINE_NUMBER=1

inputs.conf

[monitor:///u01/app/oracle/Scripts/SplunkDashboard/Check]
disabled = false
index=general
sourcetype=brm_deployment_dev
crcSalt=<SOURCE>
initCrcLength=2048
CHECK_METHOD = modtime

Re: Logs are not forwarding from the particular directory

gcusello — Sat, 15 Oct 2022 15:05:22 GMT

Hi @yuvasree,

let me understand: /u01/app/oracle/Scripts/SplunkDashboard/Check is the path or the file name?

If the path try to add * at the end.

Ciao.

Giuseppe

Re: Logs are not forwarding from the particular directory

yuvasree — Sat, 15 Oct 2022 16:22:19 GMT

Hi @gcusello

It is a path. inside that path it is having the 48 files (SQL output but with 1 or 2 lines each file).

I tried with /* but it thrown error like below.

Invalid key in stanza [monitor:///u01/app/oracle/Scripts/SplunkDashboard/Check/*] in /opt/splunkforwarder/etc/apps/search/local/inputs.conf, line 15: CHECK_METHOD (value: modtime).

Then i updated the check method in props.conf but no luck