Deployment Architecture

Why does only specific data on my UF not being sent to my Indexers?

dharveynswccd
Path Finder

Hi, here is my situation:
My Splunk environment is all Linux which exists of 3 indexers, 2 search heads and 2 log collectors running the UF client. On one of my log collectors I have a stanza written for collecting Websense logs. Here is the stanza:

                    [monitor:///iscsi/rsyslog_custom/logs/websense/hostname/*/]
                    index=main
                    sourcetype=websense:cg:kv
                    host=HOSTNAME

For some odd reason these websense logs are not being sent to the indexers. However, all other logs collected on that UF are being sent over. Clearly not a network communication issue because all other logs are being sent successfully. When run a search for sourcetype=websense:cg:kv I get diddly squat. Subsequently when do a search for index=main the hostname does not appear in the results. I have been looking through the splunkd.log file but nothing jumps out at me. Any help is appreciated. Thanks

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Filtering logs before indexing using transforms.conf and props.conf creates ingestion ...

Filtering logs before indexing using transforms.conf and props.conf creates ...

Timecharts look like very flat

<span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Jennifer_0-1656485114286.png" ...

Why getting timeout error while adding data to the Splunk cloud index from REST API?

Hello Team,<BR /><BR />I am getting timeout error while adding data to Splunk cloud index from REST API. I am ...