Data is not being registered by Universal Forwarder- Which part should I check?

[hhhwang]

Data cannot be registered by Universal Forwarder.

There are a total of 12 Universal Forwarders.

Only one of these universal forwarders registers data.

Even if I change crcSalt, the data cannot be registered.

Which part should I check?

<setting>

[monitor://D:\Splunk\iocheck\PMC*\PMC*.csv]
disabled = 0 
index = pmc
host_segment = 3
sourcetype = pmc_iotable
crcSalt = <SOURCE>

[scelikok]

Hi @hhhwang,

Yes, disabled = 0 means enabled. It is not possible to collect data with disabled = 1.

Also if the file path you monitor does not have a hostname you can delete the host_segment setting. It will capture the correct hostname of UF.

Maybe because of the wrong host value, your events are going to Splunk as if they are on the same host.

Please try deleting the host_segment line. 

I don't have any other reason for the occasional problem.

[scelikok · Accepted solution]

Hi @hhhwang,

Your input is disabled. And also please check if "iocheck" is the hostname of that sample UF. If not you should change host_segment with the correct segment. Please test below;

[monitor://D:\Splunk\iocheck\PMC*\PMC*.csv]
disabled = 0 
index = pmc
host_segment = 3
sourcetype = pmc_iotable
crcSalt = <SOURCE>

[hhhwang]

Hi, @scelikok,

disabled = 0 is enabled, disabled = 1 is disabled, isn't it?

And the host name is different from the name of UF.

Splunk is installed and used on a per-device basis, and this issue occurs occasionally. In other cases, the data is collected well.