topic Re: Forwarding from universal to index in Getting Data In

Forwarding from universal to index

keshab — Fri, 04 Nov 2011 13:16:45 GMT

It was working fine and suddenly got the following error of nowhere and not geeting data anymore.

11-03-2011 16:53:50.854 -0500 INFO PipelineComponent - MetricsManager:probeandreport() took longer than seems reasonable (12380 milliseconds) in callbackRunnerThread. Might indicate hardware or splunk limitations.
11-04-2011 00:30:10.212 -0500 ERROR TailingProcessor - Unable to resolve path for symlink: /www/logs/abc.com/access.

Any idea??

Re: Forwarding from universal to index

joshd — Fri, 04 Nov 2011 14:41:12 GMT

If you log into the machine with the forwarder, can you access the directory through the command line? Can you view the files in the directory? Does splunk have the proper permissions to view those files?

Also what does your inputs.conf look like on the forwarder?

Re: Forwarding from universal to index

keshab — Fri, 04 Nov 2011 14:44:28 GMT

It was working till midnight. It suddenly stopped and gave that error. when I restarted forwarder it started working again

Re: Forwarding from universal to index

ncsantucci — Wed, 06 May 2015 01:37:39 GMT

See http://wiki.splunk.com/Community:CallbackRunnerThreadTooLong