topic Re: Deployment client only partially forwards data in Getting Data In

Deployment client only partially forwards data

ckunath — Wed, 26 Apr 2017 13:55:30 GMT

Hello,

I have set up my Splunk Enterprise Instance as deployment-server and designated a forwarder on another machine as its deployment client.
In my $SPLUNK_HOME$/etc/deploymentapps/appname/local/inputs.conf I have these monitors configured:

[monitor:///data/crowd/logs]
disabled = false
index = crowd_dev

[monitor:///data/crowd/tomcat/logs]
disabled = false
index = crowd_dev

[monitor:///data/jenkins/.jenkins/logs]
disabled = false
index = jenkins_dev

[monitor:///data/sonarqube/current/logs]
disabled = false
index = sonarqube_dev

The first two monitors work fine, but for some reason however, I cannot find the logged data from my last two monitors.
The user that is running on the forwarding machine has rx rights on both directories, and I have no problem accessing them via CLI.

When updating the inputs.conf on deployment server side, I use ~/splunk reload deploy-server to update my deployment clients.

Is there something that I may have forgotten? Thanks in advance.

Re: Deployment client only partially forwards data

adonio — Wed, 26 Apr 2017 14:16:21 GMT

hello ckunath,
is there data under /data/jenkins/.jenkins/logs and /data/sonarqube/current/logs?
do you see errors in splunk _internal index?

Re: Deployment client only partially forwards data

ckunath — Wed, 26 Apr 2017 14:21:48 GMT

Hello adonio,
yes, there is data in both folders.
there are no errors in index=_internal sourcetype=splunkd regarding my problematic monitor-directories sadly.

Re: Deployment client only partially forwards data

somesoni2 — Wed, 26 Apr 2017 14:22:13 GMT

Try running a ./splunk list monitor to see if those paths are in the monitoring list. Also, check the splunkd.log on the forwarder to see if those paths were added to watch list or gave any error.

Re: Deployment client only partially forwards data

ckunath — Wed, 26 Apr 2017 14:49:16 GMT

They are indeed not on the monitor list despite being in the inputs.conf. Do you have any on how to fix this?

Re: Deployment client only partially forwards data

somesoni2 — Wed, 26 Apr 2017 14:54:14 GMT

What type of files you're monitoring on those folders? May be try giving full path if you're just monitoring files inside the directory you specified in the inputs.conf.

Re: Deployment client only partially forwards data

ckunath — Thu, 27 Apr 2017 06:37:48 GMT

There are simple .log files in those directories.
Now everything went confusing - ./splunk list monitor shows that two monitors are active, but I am not receiving those two on my deployment server anymore .. Are there perhaps any parameters I forgot to set in either the servers or forwarders inputs.conf or outputs.conf?

Re: Deployment client only partially forwards data

ckunath — Thu, 27 Apr 2017 11:55:44 GMT

I found the solution to my own problem.

I forgot to put the inputs.conf for my forwarders in a deployment-app, and then set it to enable on each forwarder after pushing it...
That's why it would not work. Ha!