How to edit our forwarder inputs.conf for NetApp to forward data to our indexer?

[thompsonsgg]

We have moved some of our jobs over to a NetApp configuration on a brand new server, but I cannot get the data forwarded to my Splunk indexer. I installed the forwarder and verified that I can successfully telnet from the host to my indexer and port. The machine I used to install the forwarder is able to connect to the NetApp as well.

inputs.conf configuration:

[monitor://\\netapp\BOOMI\prod\BoomiAtomsphere\logs\*.log]
disabled = false
index = boomi_prod
host = boomi-netapp
crcSalt = 

Perhaps I am using the crcSalt incorrectly?

Any help is greatly appreciated!

[skoelpin]

Is your outputs.conf pointing to the indexer?

[thompsonsgg]

Yes it's pointing to the correct indexer and port.

[skoelpin]

I would try putting a temp folder directly in your /opt directory and put a few tmp files as a test to see if you can get it working.. I'd also recommend using the base minimum in your inputs.conf .. Is your server.conf stanza correct?

And lastly, I have to ask.. Is Splunk currently running?

[monitor://\\netapp\BOOMI\prod\BoomiAtomsphere\logs\*.log]
 disabled = false
 index = boomi_prod