topic Re: Universal uploader not sending data events in Getting Data In

Universal uploader not sending data events

vikramsekaran — Sat, 05 May 2012 14:33:17 GMT

Hi,
I have a universal forwarder setup on a Linux x64 machine, with monitor setup from CLI to load a whole folder full of log files. I dono receive data events at the receiver from the log files, some of the files are reported as binary files, but even the others are not showing up. It is a trial license and I have 0 license violations, I could see the forwarder as active in the deployment monitor. I have tried cleaning the indexes and bouncing the Splunk instances on both machines, no help. We need to decide soon if we cant to stick with splunk, only if we can get this one working in the first place..

/opt/splunkforwarder/etc/system/local/outputs.conf
[tcpout]
defaultGroup = alert.example.com_9997

[tcpout:alert.example.com_9997]
server = alert.example.com:9997

[tcpout-server://alert.example.com:9997]

/opt/splunkforwarder/etc/apps/search/local/inputs.conf

[monitor:///opt/auditLogs]
disabled = false
sourcetype = OAM10gAudit

At receiver:

/opt/splunk/etc/apps/search/local/inputs.conf
[splunktcp://9997]
index = oamaudit

I have a index created as oamaudit. Am I missing anything ?

Re: Universal uploader not sending data events

Ayn — Sat, 05 May 2012 15:30:39 GMT

The index configuration parameter doesn't exist for the splunktcp input - the value for index is set when the Universal Forwarder picks up data, so that's where you should make changes if you want a monitor input to go to another index than the default.

Re: Universal uploader not sending data events

yannK — Sat, 05 May 2012 15:53:44 GMT

Currently your data should go to the main default index.

to change this modify the inputs on the forwarder

[monitor:///opt/auditLogs]
disabled = false
sourcetype = OAM10gAudit
index = oamaudit

If no data is received at all, check the network, firewall (a simple telnet alert.example.com 9997 from the forwarder should tell you)

Re: Universal uploader not sending data events

vikramsekaran — Sat, 05 May 2012 17:57:13 GMT

Thanks for the replies, the data is not received at all, I removed the index value from the indexer and the forwarder, to let it go to the default index, still nothing, I am able to connect to the indexer from the forwarder without problem. Even the log in the forwarder says connected to my indexer IP address. I am running out of options to look at.

Re: Universal uploader not sending data events

vikramsekaran — Sat, 05 May 2012 19:29:32 GMT

Thanks everyone, I think I have fixed the issue. Splunk didnot read the events because, the timestamp on the audit data was messed up and after a long try , it displayed the whole file as one event. I changed the timestamp format in the core application and it all works now. I am receiving every line as a event now. Thanks for all the support.