topic Re: Missing events from Splunk Universal Forwarder in Getting Data In

Missing events from Splunk Universal Forwarder

iancorrea — Wed, 30 Sep 2020 04:09:43 GMT

I have one missing event out of 168 events from our Universal Forwarder. I've already checked the internal logs and the file has been indexed "Batch input finished reading file=", but I cannot find this source on my index. I also tried to expand time range and nothing appears, then check if the forwarder was restarted on the time of file was index, but it is not.

Settings on my forwarder is:

inputs.conf
[batch://my_path]
move_policy = sinkhole
disabled = false
sourcetype = my_sourcetype
index = my_index

outputs.conf
[tcpout]
defaultGroup = default-autolb-group-forwarder

[tcpout:default-autolb-group-forwarder]
disabled = false
server = myIndexer:9997
useACK = true

Re: Missing events from Splunk Universal Forwarder

manjunathmeti — Tue, 11 Feb 2020 04:50:51 GMT

Is there any extraction or parsing done on sourcetype 'my_sourcetype'?

Re: Missing events from Splunk Universal Forwarder

iancorrea — Tue, 11 Feb 2020 04:52:41 GMT

yes, the other 167 events was successfully parsed

Re: Missing events from Splunk Universal Forwarder

manjunathmeti — Tue, 11 Feb 2020 05:11:38 GMT

Since this is a small file, can you use monitor instead of batch and check?

Re: Missing events from Splunk Universal Forwarder

iancorrea — Tue, 11 Feb 2020 08:12:22 GMT

I have been using batch since 1 month ago and there is no problem until this day. I cannot use the monitor because my client wants to use batch.

Re: Missing events from Splunk Universal Forwarder

nickhills — Tue, 11 Feb 2020 11:33:27 GMT

Is this one event missing from a single log file?
(ie the log contains 168 events, and only 167 have been indexed)
Or is this one event from a batch of multiple files?

The reason I ask is that it could be that the missing event did not break properly and was either merged, or dropped.

If you still have the source log file, are you able to identify which event is missing, and does it appear "well formed" in the context of the other events?