Getting Data In

Forwarder Issue

Ferrari
Explorer

There are log files in a directory and all of them were forwarded to indexer except the files starting with SystemOut* and intrestingly it got forwarded till couple of days back ( last indexed was on Feb 7th).
Tried with this option, but no use
crcSalt =

Logs have this message..

02-09-2012 20:15:53.256 -0500 INFO BatchReader - Removed from queue file='/opt/log/websphere/appserverlogs/WESB/SystemOut.log'.

Any help is appreciated

Tags (1)
0 Karma

MuS
Legend

Hi Ferrari

you can find a lot of good tips about this topic in this answer here

cheers

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...