topic Re: Universal Forwarder doesn't forward specific log in Getting Data In

Universal Forwarder doesn't forward specific log

hohyuon — Wed, 05 Jun 2024 05:16:49 GMT

Collect two logs with the Universal Forwarder.
One log is collected well, but one log is not collected.
Can you give me some advice on this phenomenon?

The input.conf configuration file.

[monitor://D:\Log\State\...\*.Log]
disabled = false
index = cds_STW112
sourcetype = mujin_CDS_IPA_Log_State
ignoreOlderThan = 1h

>>>>Not collecting

[monitor://D:\Log\Communication\DeviceNet\Input\...\*Input*.Log]
disabled = false
index = cds_STW112
sourcetype = mujin_CDS_DNetLog_IN
ignoreOlderThan = 1h

>>>>Collecting

Re: Universal Forwarder doesn't forward specific log

deepakc — Wed, 05 Jun 2024 05:50:22 GMT

You can begin by checking with these commands as it looks like a Windows UF

#Shows monitored Files

\opt\splunkforwarder\bin\splunk list monitor

#Shows monitoried file inputs status

\opt\splunkforwarder\bin\splunk list inputstatus

Have you checked permissionss for the logs that are not being collected?

Have you checked the name of the paths/logs are correct (typos)?

Check splunkd.log - there may be some further info in there

\opt\splunkforwarder\var\log\splunk\splunkd.log
(Look for TailReader OR ERROR)

Re: Universal Forwarder doesn't forward specific log

gcusello — Wed, 05 Jun 2024 06:02:04 GMT

Hi @hohyuon ,

at first run the checks described by @deepakc that are the correct ones.

Then, please, check the timestamp format: if the forma is dd/mm/yyyy you have to define this format in props.conf

TIME_FORMAT = %d/%m/%Y %T:%M:$S

because Splunk, by default, uses te american format (mm/dd/yyyy) and during the first 12 days of the month doesn't assign the correct timestamp, so today it isn't correct and you don't see events with today's date, but tomorrow date.

Ciao.

Giuseppe

Re: Universal Forwarder doesn't forward specific log

hohyuon — Wed, 05 Jun 2024 07:33:59 GMT

Thank you.
I solved it.

Re: Universal Forwarder doesn't forward specific log

gcusello — Wed, 05 Jun 2024 10:17:01 GMT

Hi @hohyuon ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉