topic Re: Issue with receiving data in Getting Data In

Issue with receiving data

Gil — Wed, 05 Jun 2024 14:24:42 GMT

hello,

I have a problem that I'm not receiving data to some of my indexes when it is related to monitoring.

for the monitor I created an app in the server I pull the data from, it worked for a while and now it stopped.
the stanza of the inputs.conf looks like that:

[monitor://\\<my_server_ip>\<folder>\*.csv] index=<my_index> disabled = 0 ignoreOlderThan = 2d sourcetype = csv source=<source_name>

it happens in 2 indexes of mine that have the same stanza structure.

I checked the connection from my server to the monitor path and it was ok.

I checked the _internal index for errors with no results.

I opened wireshark no see any connections error which i didn't found any errors.

any ideas?

Re: Issue with receiving data

gcusello — Wed, 05 Jun 2024 14:24:07 GMT

Hi @Gil,

maybe did ingestion run fine until the 31st of may and stop at the 1st of June?

if this is true, check the TIME_FORMAT of your logs: probably you are using an european date format (dd/mm/yyyy) and you didn't defined a TIME_FORMAT for your timestamps, so Splunk (that's america!) by default uses the american format (mm/dd/yyyy).

This means that you indexed todays log (5th of June) as logs of the 6th of May..

You should force the TIME_FORMAT for that sourcetype in props.conf.

Ciao.

Giuseppe

Re: Issue with receiving data

gcusello — Sun, 09 Jun 2024 16:10:39 GMT

Hi @Gil ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: Issue with receiving data

Gil — Mon, 10 Jun 2024 04:26:57 GMT

Thank you for your help.