topic Re: Why a specific sourcetype is not forwarding on a server while everything else is? in Getting Data In

Why a specific sourcetype is not forwarding on a server while everything else is?

akhil36109 — Tue, 30 Jan 2018 21:40:34 GMT

Permissions are there for the log file and no errors in the splunkd.log.
Everything seems to be working fine and everything is running as we can see that the data is forwarded at this moment. The only problem is that the specific data is not shown on the indexer, it was coming before but it stopped a few days ago.
What could be the problem?

Re: Why a specific sourcetype is not forwarding on a server while everything else is?

somesoni2 — Tue, 30 Jan 2018 22:03:08 GMT

Try running /opt/splunk/bin/splunk list monitor and see if your files/directory show up in there. Try searching splunkd.log from the forwarder with keyword as your file name (e.g. index=_internal sourcetype=splunkd host=YourHost *yourfilename*) and see if there are any warning of some sorts.

Re: Why a specific sourcetype is not forwarding on a server while everything else is?

akhil36109 — Tue, 30 Jan 2018 22:08:52 GMT

index=_internal sourcetype=splunk host=YourHost yourfilename

where shd i run this sir ?? in forwarder or indexer ??

Re: Why a specific sourcetype is not forwarding on a server while everything else is?

akhil36109 — Tue, 30 Jan 2018 22:11:36 GMT

sourcetype=splunk or sourcetype=the sourcetype which is not getting forwarded

Re: Why a specific sourcetype is not forwarding on a server while everything else is?

somesoni2 — Tue, 29 Sep 2020 17:52:32 GMT

Firstly, I had a typo in the search, just corrected it (sourcetype to be searched is splunk*d*).

Assuming your forwarder _internal logs from the forwarder to your indexers, this search should be run from your search head.

Re: Why a specific sourcetype is not forwarding on a server while everything else is?

akhil36109 — Tue, 30 Jan 2018 22:17:38 GMT

I got it sir ,sorry for silly question! i wil run them and give u the results !

Re: Why a specific sourcetype is not forwarding on a server while everything else is?

akhil36109 — Tue, 30 Jan 2018 22:21:43 GMT

Hello Sir , no errors of any sort !
what to do now

Re: Why a specific sourcetype is not forwarding on a server while everything else is?

kburtch — Tue, 27 Jun 2023 20:15:57 GMT

Has this issue ever been resolved? I am facing a very similar issue.

Re: Why a specific sourcetype is not forwarding on a server while everything else is?

isoutamo — Wed, 28 Jun 2023 08:43:58 GMT

Can you create a new question with proper and enough information, so we could better help you?