Getting Data In

Forwarding not working for some directories

Path Finder

I have a unix light forwarder that works fine for the normal default splunk forwarding (the scripts for CPU, ports, etc).

disabled = 0

Produces the expected entries on my indexer.

I added a statement for a custom directory (using a custom index):

disabled = 0

The index is created on the indexer, and 'splunk list monitor' shows the directories are being monitored on the forwarder (including many directories that shouldn't be, but I saw another question that answered that).

With all that, nothing new is added to my new index. What needs to happen to see my data on my indexer?

Splunk Employee
Splunk Employee

If possible, use Firefox to visit the Splunk forwarder's management port: https://fwder:8089/services/admin/inputstatus/TailingProcessor:FileStatus

And see what reason is provided for ignoring the files you wish to see indexed.

If it isn't possible to use Firefox, consider: wget --user=foo --password=bar https://localhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus | xmllint --format -

It's most likely just some collision with the regexes (using ... in a stanza creates an implicit whitelist). Let's see what the system thinks it's looking for.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!