How to debug missing logs in Splunk from Kubernetes

New Member

I have AWS EKS cluster and On-premise splunk. I have installed splunkconnector and setup index based routing so that each namespace logs goes to corresponding index in the splunk( index name = namespace name). I can see logs by namespace in the Splunk. Under each namespace different sourcetype exists, where each sourcetype is an application in the namespace.

In this kind of setup, if log is available in the the K8 pod but not in the Splunk. How to debug?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!