Getting Data In

Forwarders reporting in, but no log data being sent

hagjos43
Contributor

I have two nix servers that are failing to send log data over. If I search index=_internal I can see the forwarders are reporting in and at least making a connection.

Below is what the inputs.conf looks like:
[default]
host = silversurfer-production
[Monitor=///var/log/]
index = xyz

Tags (1)
0 Karma

hagjos43
Contributor

Thanks for your response, however it did not resolve the issue 😞

Anything else I can try?

0 Karma

kristian_kolb
Ultra Champion

It should be;

[monitor:///var/log]

/K

0 Karma

hagjos43
Contributor

Thanks for your response, however it did not resolve the issue 😞

Anything else I can try?

0 Karma

lukejadamec
Super Champion

Has this input worked in the past, or is this a new problem?

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Observability Cloud’s AI Assistant in Action Series: Identifying Unknown ...

Agentic AI powers the Splunk AI Assistant within the Splunk Observability Cloud interface to help you quickly ...