Deployment Architecture

Webintelligence: Data from specific server missing

Duke
Engager

Hi,

I got two VM, each of them running an apache webserver (A and B) and the splunk universal forwarder.
Both webservers produce combined-style logfiles (I made sure both are exactly the same) which the forwarder then tags explicitly as access_combined and sends to the index "webserver" on splunk master server.

I configured WI with "index=webserver sourcetype=access_c*", 127.0.0.1 as IP to exclude, "example.com" as excluded domain (I'd rather leave the field blank) and "/*.css" as excluded files.

So far so good. Now the problem:
Although the evententrys stored in the index are exactly the same (apart from obvious differences like host and source - since the logfiles are stored at different locations) only the logentrys from webserver B get processed by webintelligence, everything from A is ignored.

I tried using wi with only the logs of server A first and got stuck with the no data problem already discussed here (no data in the wi indexes what so ever). Now I'm surprised to see it working for server B.

I already checked the internal logs for errors, also completely reinstalled splunk and of course tried the common solutions of the no data problem.

What am I missing?
Thank for your help

Tags (2)
0 Karma
1 Solution

Duke
Engager

It appears I have to withdraw the question. During the wrinting of this question something magical seemed to have happend.
Maybe it was the browser cache (although I cleared that for testing alot) or something else got a lillte stuck but just like that it works.

View solution in original post

0 Karma

Duke
Engager

It appears I have to withdraw the question. During the wrinting of this question something magical seemed to have happend.
Maybe it was the browser cache (although I cleared that for testing alot) or something else got a lillte stuck but just like that it works.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...