Hi,
I got two VM, each of them running an apache webserver (A and B) and the splunk universal forwarder.
Both webservers produce combined-style logfiles (I made sure both are exactly the same) which the forwarder then tags explicitly as access_combined and sends to the index "webserver" on splunk master server.
I configured WI with "index=webserver sourcetype=access_c*", 127.0.0.1 as IP to exclude, "example.com" as excluded domain (I'd rather leave the field blank) and "/*.css" as excluded files.
So far so good. Now the problem:
Although the evententrys stored in the index are exactly the same (apart from obvious differences like host and source - since the logfiles are stored at different locations) only the logentrys from webserver B get processed by webintelligence, everything from A is ignored.
I tried using wi with only the logs of server A first and got stuck with the no data problem already discussed here (no data in the wi indexes what so ever). Now I'm surprised to see it working for server B.
I already checked the internal logs for errors, also completely reinstalled splunk and of course tried the common solutions of the no data problem.
What am I missing?
Thank for your help
