Getting Data In

Log data of a particular sourcetype from one of the forwarder is missing in splunk

Path Finder

Hi All,

In UF installed server ,we have monitor stanza to read the .log file from a particular source named it as one of the sourcetype.
I used to get the log feed upto 7 days . But suddenly it stopped and not able to see any log feed from that particular sourcetype only
But I am getting the different types of log files nearly from 8 sources from the same UF installed server to indexer

I had rebooted the UF but no luck . By running splunk btool command I can see the monitor stanza for the missing sourcetype in inputs.conf along with others

Please guide me on this

0 Karma


Hi raj_mpl,
a little question: which day of the month was the stop day, the 1st?
in this case see the timestamp format because there's an error in time format interpratation: Splunk reads mm/dd/yyy, maybe you have dd/mm/yyy.

0 Karma

Path Finder

other 8 sources also sending data to same indexes?

share inputs (from UF ) and indexes conf( from indexer)

0 Karma

Path Finder

Yes , Other sources are also sending the data to same Index


And for the same index different log from different sources are coming

0 Karma



check the _internal logs of forwarder to find out why the monitoring is suddenly stopperd. you will be able to see error message.

0 Karma

Path Finder

What happens if we restart the splunk forwarder with a root user ?

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...