https://community.splunk.com/t5/Getting-Data-In/How-to-edit-our-forwarder-inputs-conf-for-NetApp-to-forward-data/m-p/279214#M53454 <P>I would try putting a temp folder directly in your <CODE>/opt</CODE> directory and put a few tmp files as a test to see if you can get it working.. I'd also recommend using the base minimum in your <CODE>inputs.conf</CODE> .. Is your <CODE>server.conf</CODE> stanza correct? </P> <P>And lastly, I have to ask.. Is Splunk currently running?</P> <PRE><CODE>[monitor://\\netapp\BOOMI\prod\BoomiAtomsphere\logs\*.log] disabled = false index = boomi_prod </CODE></PRE> Fri, 22 Jul 2016 23:10:16 GMT skoelpin 2016-07-22T23:10:16Z https://community.splunk.com/t5/Getting-Data-In/How-to-edit-our-forwarder-inputs-conf-for-NetApp-to-forward-data/m-p/279211#M53451 <P>We have moved some of our jobs over to a NetApp configuration on a brand new server, but I cannot get the data forwarded to my Splunk indexer. I installed the forwarder and verified that I can successfully telnet from the host to my indexer and port. The machine I used to install the forwarder is able to connect to the NetApp as well.</P> <P>inputs.conf configuration:</P> <PRE><CODE>[monitor://\\netapp\BOOMI\prod\BoomiAtomsphere\logs\*.log] disabled = false index = boomi_prod host = boomi-netapp crcSalt = </CODE></PRE> <P>Perhaps I am using the crcSalt incorrectly?</P> <P>Any help is greatly appreciated!</P> Fri, 22 Jul 2016 22:09:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-edit-our-forwarder-inputs-conf-for-NetApp-to-forward-data/m-p/279211#M53451 thompsonsgg 2016-07-22T22:09:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-edit-our-forwarder-inputs-conf-for-NetApp-to-forward-data/m-p/279212#M53452 <P>Is your <CODE>outputs.conf</CODE> pointing to the indexer? </P> Fri, 22 Jul 2016 22:48:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-edit-our-forwarder-inputs-conf-for-NetApp-to-forward-data/m-p/279212#M53452 skoelpin 2016-07-22T22:48:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-edit-our-forwarder-inputs-conf-for-NetApp-to-forward-data/m-p/279213#M53453 <P>Yes it's pointing to the correct indexer and port. </P> Fri, 22 Jul 2016 22:57:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-edit-our-forwarder-inputs-conf-for-NetApp-to-forward-data/m-p/279213#M53453 thompsonsgg 2016-07-22T22:57:12Z https://community.splunk.com/t5/Getting-Data-In/How-to-edit-our-forwarder-inputs-conf-for-NetApp-to-forward-data/m-p/279214#M53454 <P>I would try putting a temp folder directly in your <CODE>/opt</CODE> directory and put a few tmp files as a test to see if you can get it working.. I'd also recommend using the base minimum in your <CODE>inputs.conf</CODE> .. Is your <CODE>server.conf</CODE> stanza correct? </P> <P>And lastly, I have to ask.. Is Splunk currently running?</P> <PRE><CODE>[monitor://\\netapp\BOOMI\prod\BoomiAtomsphere\logs\*.log] disabled = false index = boomi_prod </CODE></PRE> Fri, 22 Jul 2016 23:10:16 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-edit-our-forwarder-inputs-conf-for-NetApp-to-forward-data/m-p/279214#M53454 skoelpin 2016-07-22T23:10:16Z