Archive

splunk deployment

sswarna1
New Member

Since i had blunk changes of updating the log files on around 10 machines, I created a app in the deployment server and run the CLI command, but i can see the internal logs ingested but index created for this application showing no data post the change. what would be the issue.

Tags (1)
0 Karma

jkat54
SplunkTrust
SplunkTrust

Check

index=_internal host=yourforwarder log_level=warn* OR log_level=err*

See if any errors like permission denied.

Also be sure the forwarders restarted after the change.

Check to be sure the path in inputs.conf is correct.

Check to be sure there aren't any extra characters like windows line endings (^M) or any missing square brackets [ or ]

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What CLI command did you run? Did you look for the data in other indexes, in case there is an error in the configuration? Expand the time window of your search in case timestamps were mis-interpreted.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

sswarna1
New Member

./splunk reload deploy-server was the command for serverclass.conf file, yes in internal indexers it is working fine, latest logs are updated. but for the indexer im pointing to in the inputs.conf in app data is not showing up. if i expand timestamp late log that is showing is before the change was made those logs.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What change(s) did you make?
Does the index exist?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

sswarna1
New Member

yes index exists, changes mean changing the log path in deployment server app

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Could you be more specific about the changes made? It seems like an error may have been made with them.

---
If this reply helps you, an upvote would be appreciated.
0 Karma