topic Re: splunk deployment in Getting Data In

splunk deployment

sswarna1 — Sun, 30 Jun 2019 06:35:08 GMT

Since i had blunk changes of updating the log files on around 10 machines, I created a app in the deployment server and run the CLI command, but i can see the internal logs ingested but index created for this application showing no data post the change. what would be the issue.

Re: splunk deployment

richgalloway — Sun, 30 Jun 2019 13:54:01 GMT

What CLI command did you run? Did you look for the data in other indexes, in case there is an error in the configuration? Expand the time window of your search in case timestamps were mis-interpreted.

Re: splunk deployment

sswarna1 — Sun, 30 Jun 2019 14:03:29 GMT

./splunk reload deploy-server was the command for serverclass.conf file, yes in internal indexers it is working fine, latest logs are updated. but for the indexer im pointing to in the inputs.conf in app data is not showing up. if i expand timestamp late log that is showing is before the change was made those logs.

Re: splunk deployment

richgalloway — Sun, 30 Jun 2019 14:44:14 GMT

What change(s) did you make?
Does the index exist?

Re: splunk deployment

sswarna1 — Sun, 30 Jun 2019 14:47:47 GMT

yes index exists, changes mean changing the log path in deployment server app

Re: splunk deployment

richgalloway — Sun, 30 Jun 2019 18:02:31 GMT

Could you be more specific about the changes made? It seems like an error may have been made with them.

Re: splunk deployment

jkat54 — Wed, 30 Sep 2020 01:05:05 GMT

Check

index=_internal host=yourforwarder log_level=warn* OR log_level=err*

See if any errors like permission denied.

Also be sure the forwarders restarted after the change.

Check to be sure the path in inputs.conf is correct.

Check to be sure there aren't any extra characters like windows line endings (^M) or any missing square brackets [ or ]