Logs are not forwarded to splunk from splunk forwarder

muqeeiz — Thu, 21 Sep 2023 15:02:51 GMT

Hi,

my logs do not appear in the index and in splunkd.log i get the following error

09-21-2023 16:36:40.693 +0200 INFO AutoLoadBalancedConnectionStrategy [7698 TcpOutEloop] - Connected to idx=xx.xx.xx.xx:16313, pset=0, reuse=0. using ACK. 09-21-2023 16:36:48.003 +0200 INFO TailReader [7705 tailreader0] - Batch input finished reading file='/opt/splunkforwarder/var/spool/splunk/tracker.log' 09-21-2023 16:37:10.613 +0200 INFO AutoLoadBalancedConnectionStrategy [7698 TcpOutEloop] - Connected to idx=xx.xx.xx.xx:16313, pset=0, reuse=0. using ACK. 09-21-2023 16:37:18.002 +0200 INFO TailReader [7705 tailreader0] - Batch input finished reading file='/opt/splunkforwarder/var/spool/splunk/tracker.log'

my inputs.conf has only the following:

[default] host = myhostname index = vcenter-index-name [monitor:///var/log/remotelogs/vcenter-rep/analytics.log] sourcetype = "vcenter" queueSize = 50MB crcSalt = <SOURCE> disabled = false

I would mention that I have the same configuration on a different server and logs end out in splunk without a problem and this error does not appear on the other servers:

09-21-2023 16:37:18.002 +0200 INFO TailReader [7705 tailreader0] - Batch input finished reading file='/opt/splunkforwarder/var/spool/splunk/tracker.log'

Re: Logs are not forwarded to splunk from splunk forwarder

gcusello — Thu, 21 Sep 2023 15:18:16 GMT

Hi @muqeeiz,

sorry, but I don't see any error in the messages you shared!

anyway, check the permissions on the files to read.

Ciao.

Giuseppe

topic Re: Logs are not forwarded to splunk from splunk forwarder in Getting Data In

Logs are not forwarded to splunk from splunk forwarder

Re: Logs are not forwarded to splunk from splunk forwarder