Hi, here is my situation:
My Splunk environment is all Linux which exists of 3 indexers, 2 search heads and 2 log collectors running the UF client. On one of my log collectors I have a stanza written for collecting Websense logs. Here is the stanza:
[monitor:///iscsi/rsyslog_custom/logs/websense/hostname/*/]
index=main
sourcetype=websense:cg:kv
host=HOSTNAME
For some odd reason these websense logs are not being sent to the indexers. However, all other logs collected on that UF are being sent over. Clearly not a network communication issue because all other logs are being sent successfully. When run a search for sourcetype=websense:cg:kv I get diddly squat. Subsequently when do a search for index=main the hostname does not appear in the results. I have been looking through the splunkd.log file but nothing jumps out at me. Any help is appreciated. Thanks
