Getting Data In

How to reconfigure syslog-ng when file is getting updated but data isn't getting into indexer (Universal Forwarder)?



We have configured syslog-ng to send data to indexers, Sometimes, the syslog file is getting updated but data is not getting into indexer. For the same index we are getting data from other files but only one file is not getting indexed. We have to restart syslog splunk process to get the indexing

We have below setting configured already.

maxKBps = 0

max_fd = 1000

autoLBFrequency = 30
indexerDiscovery = masterindexdiscovery
forceTimebasedAutoLB = True
maxQueueSize = 128MB

parallelIngestionPipelines = 6

maxSize = 256MB

maxSize = 128MB


Labels (3)
Tags (1)
0 Karma



can you explain this little bit more?

Are you running syslog-ng on the same box and collecting events to file(s) by it and then ingesting those with splunk or are you sending events directly to splunk udp/tcp port?

Can you share your input definitions?

r. Ismo

0 Karma


Hi Ismo,


Yes, we are using syslog-ng and collect data using UCP&TCP to log file and using UF inputs.conf and outputs.conf, we are sending it to splunk indexers



sourcetype = juniper:firewall
index = juniper_index
#_TCP_ROUTING = splunkprodhf
ignoreOlderThan = 30d
disabled = false
host_segment = 5

0 Karma



this inputs.conf seems to be used for several nodes. Are all other working or have those also issues time by time? 

Are there any other inputs or is these syslog files only in use?

The node which you are using is linux UF with splunk UF version x.x.x?

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...