topic Re: Why is syslog data not getting indexed with my current inputs.conf on the forwarder? in Getting Data In

Why is syslog data not getting indexed with my current inputs.conf on the forwarder?

athorat — Thu, 27 Aug 2015 19:11:43 GMT

We are trying to Index data from syslog and have the following configuration in the inputs.conf on the forwarder.

[tcp://IP:10514]
index = NWK
disabled = 0
#followTail = 0
sourcetype = NW:PROD:SYSLOG

From the search head, when we use index=NWK, it does not show any data.
What can be checked to see where the connection is breaking?

Thanks,
Anil.

Re: Why is syslog data not getting indexed with my current inputs.conf on the forwarder?

diogofgm — Thu, 27 Aug 2015 20:46:28 GMT

Is that the only data source in the forwarder?
If not, are the other working ok?
If it is what's your outputs.conf like?

Re: Why is syslog data not getting indexed with my current inputs.conf on the forwarder?

athorat — Thu, 27 Aug 2015 21:06:26 GMT

No there are multiple data sources which are working using this forwarder.
outputs.conf contains server = Servernanme:9997 and some other config (is there anything which I should be looking here)

Re: Why is syslog data not getting indexed with my current inputs.conf on the forwarder?

diogofgm — Thu, 27 Aug 2015 21:09:25 GMT

If the others sources are ok I would look at the origin of the data. Or any connection between the forwarder and the IP:10514

Re: Why is syslog data not getting indexed with my current inputs.conf on the forwarder?

athorat — Thu, 27 Aug 2015 21:16:38 GMT

Yes makes sense, though what do we look at on the origin of Data.
Can you shed some light on it.

Re: Why is syslog data not getting indexed with my current inputs.conf on the forwarder?

cramasta — Thu, 27 Aug 2015 23:08:35 GMT

Is the syslog data being generated from the same host thats running the forwarder?
If it is I would suggest setting it up like this and testing.

[tcp://:10514]
connection_host = none
index=NWK
sourcetype = NW:PROD:SYSLOG

Re: Why is syslog data not getting indexed with my current inputs.conf on the forwarder?

athorat — Thu, 27 Aug 2015 23:35:17 GMT

Its coming from a different server not from the heavy forwarder.

Re: Why is syslog data not getting indexed with my current inputs.conf on the forwarder?

lguinn2 — Fri, 28 Aug 2015 00:19:54 GMT

On the forwarder, take a look at

SPLUNK_HOME/var/log/splunk/splunkd.log

This will show you if there are any error messages regarding the inputs.conf, outputs.conf etc.
Connection failures usually appear here.

Also, is there an index named NWK on the indexer?

Re: Why is syslog data not getting indexed with my current inputs.conf on the forwarder?

athorat — Fri, 28 Aug 2015 00:22:51 GMT

Yes there is a index named NWK on the indexer
And also it shows up in inex=NWK which is coming from some remote_searches.log file.
I will check from the log file in the mean time.
Thanks.

Re: Why is syslog data not getting indexed with my current inputs.conf on the forwarder?

athorat — Fri, 28 Aug 2015 08:17:17 GMT

Ok,I see this error in the log files

and thats the source ip address.
Which is up and running and have the source files.
Able to resolve the IP.
Also tried using the fQDN in the inputs.conf instead of the ip no luck.

08-14-2015 11:32:59.636 -0700 INFO TcpInputConfig - No matching config for 172.26.95.7
08-14-2015 11:32:59.636 -0700 WARN TcpInputProc - Could not find matching host.
08-14-2015 11:33:11.126 -0700 INFO TcpInputConfig - No matching config for 172.26.95.7
08-14-2015 11:33:11.126 -0700 WARN TcpInputProc - Could not find matching host.

How do I identify if Splunk is not able to get connect and fetch the data or is it something else.

Re: Why is syslog data not getting indexed with my current inputs.conf on the forwarder?

diogofgm — Fri, 28 Aug 2015 12:06:24 GMT

Is the source sending data to port 10514?
I had some issues before on network devices because some devices didn't allow me the change the port for syslog from514 and if I was are running splunk with other user than root I couldnt create inputs for port 514