https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-a-Windows-universal-forwarder-is-not/m-p/123877#M25552 <P>couple of things you can try, after seeing that message it sounds like parsing Que issue.<BR /> you can try increase <BR /> maxQueueSize = 200MB in outputs.conf.<BR /> some times the maxQueueSize setting causes events to be loaded into a queue in memory so Before increase check your memory and performance using top what ever OS command.<BR /> Note: check out metrics.log and parsingQueue or TCPque is full etc errors</P> Tue, 31 Mar 2015 20:05:52 GMT brod_geico 2015-03-31T20:05:52Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-a-Windows-universal-forwarder-is-not/m-p/123876#M25551 <P>We are having an issue where a Universal Forwarder configured to forward a half dozen custom application logs is not forwarding any of them. It is a Windows server, and we are seeing Windows security information come across, and if I point to a known log, c:/\windows/\windowsupdate.log in inputs.conf, it sends that along. However, the other files are not coming across to the indexer.</P> <P>They use custom sourcetypes that have been correctly specified and I can examine and appear to be set up correctly. The types are specified in inputs.conf for each file stanza and I can see them in Splunk's props.conf. </P> <P>I cannot see a reason that only our custom files would be ignored. In splunkd.log on the forward it acknowledges their stanzas for each file:</P> <PRE><CODE>03-31-2015 12:48:41.248 -0400 INFO TailingProcessor - Parsing configuration stanza: monitor:// </CODE></PRE> <P>There are no warnings or errors in the log file.</P> <P>Splunk is running as a local system account and has permissions to the files.</P> <P>I do not know what could be causing this issue and I am unsure where else I can look to diagnose the issue.</P> Tue, 31 Mar 2015 19:12:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-a-Windows-universal-forwarder-is-not/m-p/123876#M25551 awendler 2015-03-31T19:12:32Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-a-Windows-universal-forwarder-is-not/m-p/123877#M25552 <P>couple of things you can try, after seeing that message it sounds like parsing Que issue.<BR /> you can try increase <BR /> maxQueueSize = 200MB in outputs.conf.<BR /> some times the maxQueueSize setting causes events to be loaded into a queue in memory so Before increase check your memory and performance using top what ever OS command.<BR /> Note: check out metrics.log and parsingQueue or TCPque is full etc errors</P> Tue, 31 Mar 2015 20:05:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-a-Windows-universal-forwarder-is-not/m-p/123877#M25552 brod_geico 2015-03-31T20:05:52Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-a-Windows-universal-forwarder-is-not/m-p/123878#M25553 <P>Thanks, I've tried that but it does not seem to have changed anything. I'm pulling the log files on the forwarder and I will examine the metrics.log</P> Wed, 01 Apr 2015 14:37:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-a-Windows-universal-forwarder-is-not/m-p/123878#M25553 awendler 2015-04-01T14:37:11Z