topic Data Ingest issues in Getting Data In

Data Ingest issues

ChristianF — Tue, 05 Sep 2023 15:42:59 GMT

Howdy Splunkers,

Working on my Splunk deployment and ran into a funky issue. I am ingesting Palo Alto FW and Meraki network device logs via syslog server. Rsyslog is set to write logs down to a file and the UF is set to monitor the directories.

No issues there, however I do run into an issue why I try to source type or set an index for these logs. I have edited the indexes.conf in the local folder on my cluster manager and pushed the required indexes to my indexers. When I go to search for the logs on my search head I cannot find any data. However it works properly whenever i do not have sourcetyping and index destination in my inputs.conf.

Any idea as to why?

Re: Data Ingest issues

PickleRick — Tue, 05 Sep 2023 20:27:15 GMT

We need more info. Especially relevant configs.

Re: Data Ingest issues

Manojbh_splunk — Tue, 05 Sep 2023 21:05:21 GMT

Are you monitoring the path where the logs are written in the UF.

can you share your inputs.conf ? this will help you check further.

Re: Data Ingest issues

ChristianF — Wed, 06 Sep 2023 12:17:25 GMT

I actually ended up resolving the issue myself, I didn't have my indexes.conf file on my search head which didn't allow me to see the data on my cluster.

Re: Data Ingest issues

PickleRick — Wed, 06 Sep 2023 15:52:31 GMT

Lack of indexes.conf on SH results only in lack of auto-completion in the search edit window. You still can manually write which index you want to search and it works.