Getting Data In

How to debug why a universal forwarder is parsing files from paths but no data is ingested?

jvmerilla
Path Finder

Hi Everyone,

I am trying to monitor xml files from a directory in a certain server. But for some unknown reason/s no data is coming in.

I have tried different path in the inputs.conf assuming that the provided path is not correct.

As I check on the _internal logs, I can see the following events will all the paths I have in my inputs.conf. However, there's still no data ingested.

TailingProcessor - Adding watch on path: <path1>
TailingProcessor - Adding watch on path: <path2>
TailingProcessor - Adding watch on path: <path3>
TailingProcessor - Parsing configuration stanza: monitor:<path1>
TailingProcessor - Parsing configuration stanza: monitor:<path2>
TailingProcessor - Parsing configuration stanza: monitor:<path3>

What could be error in this?

Hope someone could help me with this.

Thanks in advance!

Tags (1)
0 Karma

harsmarvania57
Ultra Champion

If you are using Splunk UF 6.3+ then you can use below command on UF to check monitoring status of various files.

$SPLUNK_HOME/bin/splunk list inputstatus
0 Karma

jvmerilla
Path Finder

Hi @harsmarvania57,

Thanks for your comment.
Unfortunately, we do not have access on the server.
Hopefully, we will be given access so we can check.

Thanks again!

0 Karma

woodcock
Esteemed Legend

You need to show us the inputs.conf file, at a minimum. The more/better information that you provide, the better we can help you.

0 Karma

jvmerilla
Path Finder

Hi @woodcock,
Below is a sample of the inputs.conf

[monitor://G:\rcad.net\dfs\TEST\SAMPLE\PROD\BTS-TEST-Testing-PROD-NAV\ERROR\]
whitelist=.*\.xml
disabled = false
index = test_index
sourcetype = test_srctype

[monitor://G:\rcad.net\dfs\TEST\SAMPLE\PROD\BTS-TEST-Testing-PROD-NAV\ERROR\*.xml]
disabled = false
index = test_index
sourcetype = test_srctype 

I have tried using whitelist but it still does not work.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...