Getting Data In

Forwarding not working for some directories

mbrunetto
Path Finder

I have a unix light forwarder that works fine for the normal default splunk forwarding (the scripts for CPU, ports, etc).

So:
[monitor:///var/log]
whitelist=(\.log|log$|messages$|mesg$|cron$|acpid$|\.out)
blacklist=(lastlog)
index=os
disabled = 0

Produces the expected entries on my indexer.

I added a statement for a custom directory (using a custom index):

[monitor:///services/.../logs]
whitelist=(\.log$|log$|messages$|mesg$|cron$|acpid$|\.out$)
blacklist=(lastlog$|\.gz$|^splunk|\.xml$|\.conf|^metrics)
index=services
disabled = 0

The index is created on the indexer, and 'splunk list monitor' shows the directories are being monitored on the forwarder (including many directories that shouldn't be, but I saw another question that answered that).

With all that, nothing new is added to my new index. What needs to happen to see my data on my indexer?

amrit
Splunk Employee
Splunk Employee

If possible, use Firefox to visit the Splunk forwarder's management port: https://fwder:8089/services/admin/inputstatus/TailingProcessor:FileStatus

And see what reason is provided for ignoring the files you wish to see indexed.

If it isn't possible to use Firefox, consider: wget --user=foo --password=bar https://localhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus | xmllint --format -

It's most likely just some collision with the regexes (using ... in a stanza creates an implicit whitelist). Let's see what the system thinks it's looking for.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!