topic Unable to add more sources to Universal Forwarder in Getting Data In

Unable to add more sources to Universal Forwarder

yossefn — Thu, 18 Jan 2018 14:31:57 GMT

Hi,

I'm pretty new in the Splunk field.
I've installed a little environment of Splunk on virtual machine and Universal Forwarder on my own machine (both are windows).
When I'm trying to add more sources to the Forwarder such as log file, I can see the changes in the App's inputs.conf file but there are now events getting in to the system. I did a restart to the splunkd service on my machine and didn't help.
What I'm missing here?

Re: Unable to add more sources to Universal Forwarder

skoelpin — Thu, 18 Jan 2018 17:21:04 GMT

You should check out /opt/splunkforwarder/var/log/splunk/splunkd.log for errors

Re: Unable to add more sources to Universal Forwarder

davpx — Thu, 18 Jan 2018 23:18:03 GMT

would you mind posting the inputs.conf stanza you are using?

Re: Unable to add more sources to Universal Forwarder

HiroshiSatoh — Fri, 19 Jan 2018 00:32:31 GMT

Can I search Forwarder's system log?
If you can not find it, it's a problem with the network or outputs.conf.
If you can search it is a problem with inputs.conf.
Mistakes in setting, differences in character codes, etc. can be assumed.

Re: Unable to add more sources to Universal Forwarder

yossefn — Mon, 22 Jan 2018 15:31:21 GMT

Hi davpx,

Here is what I have in the inputs.conf file under "C:\Program Files\Splunk\etc\system\local"
This is the one you're looking for?

[default]
host = S0011
index = mypc

Re: Unable to add more sources to Universal Forwarder

yossefn — Mon, 22 Jan 2018 15:33:35 GMT

Hi skoelpin,

The attached error are appears many times in the splunkd.log file

ERROR KVStorageProvider - An error occurred during the last operation ('saveBatchData', domain: '11', code: '22'): Cannot do an empty bulk write