topic log injection configuration in Getting Data In

log injection configuration

raghunandan1 — Thu, 21 Dec 2023 22:24:21 GMT

Recently configured a new input that has successfully ingesting logs but appears to be working intermittently. There is large gaps in logs that we have confirmed are present and being created regularly from the source server.

Example : Logs are captured 8th December and 16 December only. So, here 9th December to 15nth December logs are not captured

We have created custom app on our deployment server and push that app across all the deployment slaves.

The data flow is coming from source-->Universal forwarder-->Heavy forwarder--> Splunk cloud

we have created Inputs.conf

[monitor://F:\Polarion\data\logs\main\*.log.*]
sourcetype = catalina
index = ito_app
disabled = false
ignoreOlderThan = 7d
initCrcLength = 10000

Please help on the issue

Thank you

Re: log injection configuration

isoutamo — Thu, 21 Dec 2023 23:25:11 GMT

this https://community.splunk.com/t5/Getting-Data-In/Only-first-line-from-logfile-is-logged/m-p/672184#M112607 is probably quite similar case?

r. Ismo

Re: log injection configuration

VatsalJagani — Wed, 27 Dec 2023 11:54:45 GMT

@raghunandan1 - Please search in the index=_internal to see if you have errors related to file monitoring from those hosts.

I hope this helps!!!