Getting Data In

Forwarding not working for some directories

mbrunetto
Path Finder

I have a unix light forwarder that works fine for the normal default splunk forwarding (the scripts for CPU, ports, etc).

So:
[monitor:///var/log]
whitelist=(\.log|log$|messages$|mesg$|cron$|acpid$|\.out)
blacklist=(lastlog)
index=os
disabled = 0

Produces the expected entries on my indexer.

I added a statement for a custom directory (using a custom index):

[monitor:///services/.../logs]
whitelist=(\.log$|log$|messages$|mesg$|cron$|acpid$|\.out$)
blacklist=(lastlog$|\.gz$|^splunk|\.xml$|\.conf|^metrics)
index=services
disabled = 0

The index is created on the indexer, and 'splunk list monitor' shows the directories are being monitored on the forwarder (including many directories that shouldn't be, but I saw another question that answered that).

With all that, nothing new is added to my new index. What needs to happen to see my data on my indexer?

amrit
Splunk Employee
Splunk Employee

If possible, use Firefox to visit the Splunk forwarder's management port: https://fwder:8089/services/admin/inputstatus/TailingProcessor:FileStatus

And see what reason is provided for ignoring the files you wish to see indexed.

If it isn't possible to use Firefox, consider: wget --user=foo --password=bar https://localhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus | xmllint --format -

It's most likely just some collision with the regexes (using ... in a stanza creates an implicit whitelist). Let's see what the system thinks it's looking for.

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...