<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Why is my forwarder not forwarding data other than _internal? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Why-is-my-forwarder-not-forwarding-data-other-than-internal/m-p/457515#M79059</link>
    <description>&lt;P&gt;I have forwarder not forwarding any input data other than _internal. &lt;/P&gt;

&lt;P&gt;Checks performed:&lt;BR /&gt;
splunk version - 6.4.2&lt;BR /&gt;
Forwarder is up and running.&lt;BR /&gt;
Checked the $SPLUNK_HOME/etc/system/local/inputs.conf . -- Checked the host name&lt;BR /&gt;
Checked the $SPLUNK_HOME/etc/system/local/deploymentclient.conf&lt;BR /&gt;
Checked the $SPLUNK_HOME/etc/system/local/server.conf &lt;BR /&gt;
I don't see any error/warning in splunkd.log.&lt;BR /&gt;
File path for the log files. &lt;/P&gt;

&lt;P&gt;I have restarted the forwarder several times but no luck. &lt;BR /&gt;
The inputs in the /etc/app are not forwarding. &lt;/P&gt;

&lt;P&gt;Please advise.&lt;/P&gt;</description>
    <pubDate>Tue, 29 Sep 2020 21:15:06 GMT</pubDate>
    <dc:creator>sathiyasun</dc:creator>
    <dc:date>2020-09-29T21:15:06Z</dc:date>
    <item>
      <title>Why is my forwarder not forwarding data other than _internal?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Why-is-my-forwarder-not-forwarding-data-other-than-internal/m-p/457515#M79059</link>
      <description>&lt;P&gt;I have forwarder not forwarding any input data other than _internal. &lt;/P&gt;

&lt;P&gt;Checks performed:&lt;BR /&gt;
splunk version - 6.4.2&lt;BR /&gt;
Forwarder is up and running.&lt;BR /&gt;
Checked the $SPLUNK_HOME/etc/system/local/inputs.conf . -- Checked the host name&lt;BR /&gt;
Checked the $SPLUNK_HOME/etc/system/local/deploymentclient.conf&lt;BR /&gt;
Checked the $SPLUNK_HOME/etc/system/local/server.conf &lt;BR /&gt;
I don't see any error/warning in splunkd.log.&lt;BR /&gt;
File path for the log files. &lt;/P&gt;

&lt;P&gt;I have restarted the forwarder several times but no luck. &lt;BR /&gt;
The inputs in the /etc/app are not forwarding. &lt;/P&gt;

&lt;P&gt;Please advise.&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 21:15:06 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Why-is-my-forwarder-not-forwarding-data-other-than-internal/m-p/457515#M79059</guid>
      <dc:creator>sathiyasun</dc:creator>
      <dc:date>2020-09-29T21:15:06Z</dc:date>
    </item>
    <item>
      <title>Re: Why is my forwarder not forwarding data other than _internal?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Why-is-my-forwarder-not-forwarding-data-other-than-internal/m-p/457516#M79060</link>
      <description>&lt;P&gt;Does the log files have data in them to forward?&lt;BR /&gt;
Cross check the path for any type-o ?&lt;/P&gt;</description>
      <pubDate>Thu, 13 Sep 2018 20:30:43 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Why-is-my-forwarder-not-forwarding-data-other-than-internal/m-p/457516#M79060</guid>
      <dc:creator>pradeepkumarg</dc:creator>
      <dc:date>2018-09-13T20:30:43Z</dc:date>
    </item>
    <item>
      <title>Re: Why is my forwarder not forwarding data other than _internal?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Why-is-my-forwarder-not-forwarding-data-other-than-internal/m-p/457517#M79061</link>
      <description>&lt;P&gt;Fixed, There was an mistake in the inputs whitelist. It works now. Thanks.&lt;/P&gt;</description>
      <pubDate>Thu, 13 Sep 2018 21:00:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Why-is-my-forwarder-not-forwarding-data-other-than-internal/m-p/457517#M79061</guid>
      <dc:creator>sathiyasun</dc:creator>
      <dc:date>2018-09-13T21:00:34Z</dc:date>
    </item>
  </channel>
</rss>

