topic Re: Why are the logs being forwarder from one source to the Splunk indexer in a Splunk forwader deployed on a Windows server? in Getting Data In

Why are the logs being forwarder from one source to the Splunk indexer in a Splunk forwader deployed on a Windows server?

venksel — Thu, 09 Aug 2018 23:31:54 GMT

Hi there,
We have Splunk forwarder deployed on a Windows server and inputs.conf is configured with two log sources.

[default]
host = test_OP_CBE_AUX1

[monitor://C:\ClearPath\logs]
whitelist = [\\]cpe2Pims-\d\d\d\d_\d\d_\d\d\.log$
index = pb
sourcetype = json
recursive = false
disabled = false

[monitor://C:\ClearPath\logs\CatalogUpdater]
whitelist = [\\]UnclassifiedExtractor_splunk\.log
index = pb
sourcetype = json
recursive = false
disabled = false

However, we are seeing logs forwarded to Splunk indexer only from [monitor://C:\ClearPath\logs] and other source [monitor://C:\ClearPath\logs\CatalogUpdater] does not forward the logs.

If set disable to "true" for [monitor://C:\ClearPath\logs] -- we immediately see logs being forwarded from [monitor://C:\ClearPath\logs\CatalogUpdater]

This is not a licensing issue. Any inputs on what's causing this issue will be greatly appreciated.

Cheers,
Pam

Re: Why are the logs being forwarder from one source to the Splunk indexer in a Splunk forwader deployed on a Windows server?

anthonymelita — Fri, 10 Aug 2018 17:26:17 GMT

This is a bit of a shot in the dark, but have you tried moving the second input stanza above the first one? Splunk plays by it's own set of order of operations, and maybe the recursive=disabled in the first stanza is blocking the second input which exists in a subdirectory.

Re: Why are the logs being forwarder from one source to the Splunk indexer in a Splunk forwader deployed on a Windows server?

venksel — Fri, 10 Aug 2018 17:37:22 GMT

anthonymelita - Problem solved!

You are the best and thank you so much for taking time to reply.

Cheers and a happy forth!

Re: Why are the logs being forwarder from one source to the Splunk indexer in a Splunk forwader deployed on a Windows server?

ddrillic — Fri, 10 Aug 2018 17:38:03 GMT

I'm not crazy about the whitelist way.

What about something like? -

[monitor://C:\ClearPath\logs\cpe2Pims-*.log]
.....

[monitor://C:\ClearPath\logs\CatalogUpdater\UnclassifiedExtractor_splunk.log]
.....

It's simpler...

Re: Why are the logs being forwarder from one source to the Splunk indexer in a Splunk forwader deployed on a Windows server?

venksel — Fri, 10 Aug 2018 17:42:14 GMT

ddrillic - it's resolved after following the recommendation from Anthony. I appreciate you taking time to reply to my post and your willingness to help is greatly appreciated.

Re: Why are the logs being forwarder from one source to the Splunk indexer in a Splunk forwader deployed on a Windows server?

ddrillic — Fri, 10 Aug 2018 17:45:44 GMT

Sounds great! recursive = false applies on the entire [monitor://C:\ClearPath\logs]. That's another reason why my suggestion should work and keep it clearer ; -)