topic Debugging universal forwarder sinkhole ingestion in Getting Data In

Debugging universal forwarder sinkhole ingestion

garrettsdet — Wed, 20 Jan 2021 19:30:44 GMT

Hi! I have a local setup where I have splunk Enterprise, and a single universal forwarder monitoring an arbitrary Documents folder:

The forwarder is set up to send entire files to splunk with these inputs.conf settings:

[batch://C:\Users\Currentuser\Documents\TestSplunk]
disabled = 0
sourcetype = BugReport
move_policy = sinkhole
index = sandbox

When I place a text file into this TestSplunk directory, it does disappear, showing that the forwarder had picked it up, and disposed of the file as per the move_policy. However, from Splunk enterprise, I can't seem to see evidence of the file being received. In the splunkd.log belonging to the forwarder, I don't see any message with regards to the file that it detected/sent/deleted. How would I be able to see information about this kind of thing?

Re: Debugging universal forwarder sinkhole ingestion

richgalloway — Wed, 20 Jan 2021 21:03:03 GMT

Have you tried this search? If not, what did you try?

index=sandbox sourcetype=BugReport earliest=0 latest=+1y

Re: Debugging universal forwarder sinkhole ingestion

garrettsdet — Wed, 20 Jan 2021 21:49:22 GMT

Thanks Rich!

The search worked and showed a bunch of events for the two files I ingested. I tried a search earlier today of sourcetype=BugReport, but that didn't work. I guess I need to study the search syntax more closely, maybe do some tutorials.

Thanks for the help!

Re: Debugging universal forwarder sinkhole ingestion

richgalloway — Thu, 21 Jan 2021 13:17:23 GMT

It's important to always specify an index in your searches because the default index(es) for your role may not be the one(s) where the data resides.