Getting Data In

Recent logs are not available in splunk even if recent internal logs are missing. How to fix the issue?

isahu
Observer

I onboarded one production logs to splunk but after restarting the UF I am not able to see the recent logs also I am not able to see the recent internal logs. How to fix this issue please help?

Labels (1)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @isahu 

Can you have a look at $SPLUNK_HOME/var/log/splunk/splunkd.log specifically errors relating to "TcpOutputProc" or "TcpOutputFd".

Please also confirm that the outputs.conf is configured as expected using btool:

$SPLUNK_HOME/bin/splunk cmd btool outputs list --debug

As others have said, the lack of _internal logs from the UF points to an issue with sending outbound, hopefully the above troubleshooting will help determine the cause of the issue.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Can you check on UF side what it has written into local log files? There should be information why it can’t send those into your indexers.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If neither the production logs nor the internal logs from the same UF are found then it's likely that the UF has lost its connection to the indexer(s).

Verify the UF has the right settings in outputs.conf

Verify the network still allows connections from the UF to the indexers.

If you use TLS, confirm the certificate is still valid and that the UF has the correct password.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...