Issue with receiving data

[Gil]

hello,

I have a problem that I'm not receiving data to some of my indexes when it is related to monitoring.

 for the monitor I created an app in the server I pull the data from, it worked for a while and now it stopped.
the stanza of the inputs.conf looks like that:

[monitor://\\<my_server_ip>\<folder>\*.csv]
index=<my_index>
disabled = 0
ignoreOlderThan = 2d
sourcetype = csv
source=<source_name>

it happens in 2 indexes of mine that have the same stanza structure.

I checked the connection from my server to the monitor path and it was ok.

I checked the _internal index for errors with no results.

I opened wireshark no see any connections error which i didn't found any errors.

any ideas?

[gcusello · Accepted solution]

Hi @Gil,

maybe did ingestion run fine until the 31st of may and stop at the 1st of June?

if this is true, check the TIME_FORMAT of your logs: probably you are using an european date format (dd/mm/yyyy) and you didn't defined a TIME_FORMAT for your timestamps, so Splunk (that's america!) by default uses the american format (mm/dd/yyyy).

This means that you indexed todays log (5th of June) as logs of the 6th of May..

You should force the TIME_FORMAT for that sourcetype in props.conf.

Ciao.

Giuseppe

[gcusello]

Hi @Gil ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[Gil]

Thank you for your help.